Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
48b92883a6125191c655533698002e52_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
48b92883a6125191c655533698002e52_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
48b92883a6125191c655533698002e52_JaffaCakes118.html
-
Size
213KB
-
MD5
48b92883a6125191c655533698002e52
-
SHA1
558dcc6330bc01eae767333193f11a05f156c31a
-
SHA256
b8b78c4f407c516c664e5e3665c0dea939585c0d3a2c643af4d5fbd5748b88cd
-
SHA512
90324350fc30731d10f28b56792b4457f84df7212106567f503275d9e45dfb1b92291ac9fcd9014f45dbe96810359061b0b92d1ed1143be14ec66cdc50cf1e1d
-
SSDEEP
3072:SY/cEhM8Qex66LcqyfkMY+BES09JXAnyrZalI+YQ:SY08xHcPsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421980729" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CCD3491-131A-11EF-A4DC-6EC9990C2B7A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1776 iexplore.exe 1776 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1776 wrote to memory of 3044 1776 iexplore.exe 28 PID 1776 wrote to memory of 3044 1776 iexplore.exe 28 PID 1776 wrote to memory of 3044 1776 iexplore.exe 28 PID 1776 wrote to memory of 3044 1776 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48b92883a6125191c655533698002e52_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eeef820ba9a02c07c3f4964175059b4
SHA13933a9560790b4386630c5ccc84cf03b5ae5b66a
SHA25685c9888fdd87453286c68098079fae6f25912434d98b06e4419051e5f79d5689
SHA51210234e029c48748b97dfed455c48762c9ec9fc31b48ec73783e45ed4b61ce1cbf749c69db7e14d3fbdd044f99e1fe0b8c3feb8c85b9d3e51ca364392f77bf167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea0b053b467e32b3cee50b1942af5a80
SHA1c057a62e965af52a08677b0b1e8965456e918388
SHA2560bd57650a7c1ad7ab0f56b1e2fe137d41ad65624d7c6ce97cf165e0bd1d52718
SHA512398711cf98481652f3f8e4a77dcb5f78b273b467b167e75bed36c9b18282c9dc8d24f836a3078d32a3b3ce326f3e01c8cd37f144811e3d489608926fc8468ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cd29441b9529e1dd9e6dba4690a3665
SHA1b8b3c7ae6aaaa20dd498051ac7c8811c8cd74b59
SHA256ac3a11e66ad27b17f72cc8e3be31e698f99e4e24a30b965f83cc2adad7511872
SHA512066d7b5f5a30762f4e77a03b88f2ec3737f6b438fdd164ebfaeff35ee3eab8d9a590e792b19a6a948b829c6c898d6c4ed1aa92d3c07e7767513985ca8d7a1959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ca61bac584fe02f0486f12fb4359b97
SHA1842fec3126b82508abe33a01e41e3c00efc1818c
SHA2560de929f95c3866282d48863a5217bf006f5157e8f26033bf9e7a76e97c2a90c2
SHA5128a8fa1e74aae09dc0791f33993d37d18859543a337a15db92e287067addb31655e2baff1e42e31bc3960fb95269da2ce756c090d9dc64768f35c3c3480b33ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5386686a81f137ce4fb00c84c6830929d
SHA141db5025822eb90f9858493d3876534323d21c4e
SHA256d13b4d5fd505662b658968d0f30c7fc75b2d95bfae08c45e35aef28de6e23c21
SHA512e3f22d08cf1f9dc7df07a38ed1285645e09825f4bd270e32a60bd663b353c1853b7b9152aa2b66a66d65a7ef4138dbf20b00582790b942dbeffe49e78c7c7718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dae95890a98f5cf684ff9cfde165926e
SHA1f646d24373d33b9ec3934f04a52db10cdf2e0c28
SHA2569f2f9fe1e3c47bba09b6416b7f140947cc51bb50b692589af64e55f12615be38
SHA5120aff63993301424c4fda36e09159c61bdb376e20b1f8aa81d33295954e5ad191f411870f51396bb2497be34b1d0105d56e698771a2a5dd0257a720a738a78710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5220fe465aa0bc54ecee4c29e08f0b051
SHA17742459a4fb53f2ec8d02ad7738bc132420bd21d
SHA256c21aa64c3b8f8f039c817f00528e158c82a19efbab0b860cf6a20a7e03b2ec6b
SHA512ff989984a53ae5e00bbc63fe47d5a820e46c5343e9a3e719b77b26543359cee757f7111f8a4ee68521da6f500c20e2cd9b9030df15f7eaca6703a73cc1b42e5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598fa315dcbcae78a97203eb09cbbe572
SHA1b7a251fa8126158c3680735cb705f35b1581e3e5
SHA25641b78a5f0b040b36a083b5d27224b3e4163cec6fb9b9259f540c53e6097837b2
SHA512457d02d9d619ab436bdee2aa9ebc1cbe6a3cc34b99c93939380ae87fb219f4d314796c71f929d49ce52a6d9feb28e76f33143f847c14be4344f1da28aa88eaa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5643cbd37b2ba9c7d19649193cad196e5
SHA1dfd011e1a4e6a1db92b788e176bb8bae7e016e8b
SHA25654c2984e3f08d04fcc65bdfcc2a6a6463d4752412f39698c73fa5f4e1df0185f
SHA51221ede871ac8e34debd5d02be02c5058d9d6cc4832ad400261ccc0b892c8a891832f24d865711bd3cc32851a3522cd71a42d7bb7cd9bb7ca7820d7cc1734bbbd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d96f8eddcc5b9b2bf6d5763f782d8025
SHA1203fbdd56c421dbcd38a5037ee91fc68833288ee
SHA2566b201cf33f970cb96e8746831e8046a33e9d13fe40d00f8839afa71e85dba79a
SHA512f00b8736d3f36d64c39c77dc25645e99b69112fdae9c7ce4b7932d08f00a6040762bb0a01e6f7a5decea7d78d8ab1fe6a9639ef466adb0be2a0ed781eb102817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f8ff79ee456d98c6e85dc6d2f18a8e3
SHA1a01f57d35a73fa9a28a709bbeb1f31ea3351f1d8
SHA256074821e53aeca3ca61fbec345a111336ed9c7dde7c833251eb267cecbd109538
SHA5128643d6cd4c5b641832c9bfa65a0c6e1463e949209caf026b7949de41cacdaddd83ec8e82b45075618badc10cede762fee409209d4895d095de875c293fc39baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55582c29338a3cdff3ccc905a2f8b68c4
SHA16b21a97db87fc1974c389d8cd44fee9ddccfcb03
SHA25628b171781785a2a456ee9da17d1fc9a1edb9fec644c9dcbb105e1dca9267fb12
SHA512513682840da65df589a3a51d33c00baf7f2025d53bb69560a44fb655a2847b9539d10ddca0987e02a7249057e0b05eff91cb7984bcb223082ee18ecea34a95cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db9ed21a6d43cbf7a9d54a64007d7841
SHA1c60a272f8d39ded3d7c7e8368df134c71df9b949
SHA256986b2389306aabd0144a95077a834529a859a2d5c92e4d841b42cb2086356463
SHA51203fb6823c194003fa0616a1799960488a67358d1ff4efc7f6d466cc090045688ef913470bac9f408b9a09dfd9e69ed367e126f5aa11e8712b4ec5a95d5c6b362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc7a070e660c1f300829bf5a8f5811b1
SHA1fe36607900e2529edfe3edc482a352e345e17cb3
SHA25693acf987aae18f08ae8759463223f57240494d39ecd52d80868bd567d402a542
SHA51263014e94e1545596fc1fedccbcfa8bddab0cf77528b77e1c82c01adc37510dc5124b589e40e419a4126ee5cd3c5ce5e1322da8ced546985fe68a97a9c82b0f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b512311dae65169ab0b2740c02275285
SHA18a62b9e26e5d5c1c5f15bb340bf8732e9990d779
SHA2563850eaf2d366fdae990f1d4f4b2a33ec4bc341a71b99cb0be0467cfef74c53fe
SHA512a45ad91cb84e2c9b94c562d29bf169b010be16f8e2f136030c4569f22a2f1eb04cd5119473e5bb54e44fcb52f3c1c78d6264bf97bf5deb2a1b2ec060e9779a85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5364bab7b7f084f3749b9a1ec797aaa50
SHA1bcb8cd834839651057905aaed115ebfaa9b1360f
SHA2560bbf65a41eb910e632ff9d7cd1544d86791ef2eccd4c36bc9ebe8b06234959c9
SHA51278459e2f75882b1526a6af0f0a90e88ac5b1d125de1ccb252e4e42b5cb2b5458177639897b3e7c40957df0ffd4de27dbb8127c266da99c36636202674867433a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cf72e396d297f833b732ffeee1fed04
SHA149795c23b3d2e4c85021aa24d78fac2ba3e4972c
SHA25654d3f1cfc90389f2e87c596f9e3d016cd259183930af110ba8ea451bb43a9ac7
SHA5128d480d9aca5291f0bfffcb1fd0f18596d764566331e8e4c47a95e0c102f87fab9c8586c6eefb3b3e2d12c3f8e33f71a302d449e89cb7a7e863d36c2f5146a6c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56674c4cf4f3bc0b58ef0e7242e13b2e9
SHA1aaf3cf89c085bd81315c03fb01b0cb896ebb9511
SHA2565df204bb1bfb0363d5eb5905b45e5352a08d746e3ee2076c99c7f7587aceae3c
SHA512549ad53a912f72b8ca20ae9ab3b0010194d3e641d6ad4fd25330ebad67b2c213c954ead4efeb77b48f43217460eda62e3a97abb0d3d96ee2992217ecffb25038
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1170a14f2fe5e860051866f89351dc8
SHA10add71c368a6c18fa92b9a3b88b16a3ebe2afc95
SHA256a7b88bf51bbb5011d3f4993c596a22b91f90117478f7ffbcbc87fad5cdc475c0
SHA512ba88a350926cccb045c074450c42089e6dbb5f7c089404b438c8962340742c9644a78790ee7ae344fb9986269c5b6534c8f5c35f7143f6a3350d45bfa8ab2650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52531fd9291f03375c29af4e977289505
SHA17ee62ade3828ef41f35231ede35244c213cc1316
SHA256b828a5aa1791566aed790705cc6c517f6d1e616bae98bfe8a4a499c834b5449e
SHA512efe2815484919d8690e6c29ee2a8241122ef30b68ff2b80a1309813281002663cf396c59b454a0594dc4573831f863b1b469ae86015a8766bb75eae6ddd6329f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59317c573933a221b4840c61d846c1856
SHA1ad3a69147ef09f30d0b5e984e6e85f7cb542ae23
SHA256b3faca4b0023504d3f77b3d936d51e8e741cb5d0e701ae58a47da53a047f6f66
SHA5120526331e7f0c5669a1727e2ded840ede811653442d2b9042dac547c16027e42d0264af42d28e08d0fb453e33e2e67239c67142e654289d06fd9841088a69b677
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a