Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
4b7d3e4f2ef3810a45ed4a7cb72db092_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b7d3e4f2ef3810a45ed4a7cb72db092_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4b7d3e4f2ef3810a45ed4a7cb72db092_JaffaCakes118.html
-
Size
118KB
-
MD5
4b7d3e4f2ef3810a45ed4a7cb72db092
-
SHA1
b3fa4985e960e56bbd89cdb90d7beabdba21ec71
-
SHA256
c6fc362c70049cefd5fa29a9aa57cbdfe4f7be5156ebc29e3d10e7f7e0862bde
-
SHA512
789f9caac9bb49e0ecbaff22d51069755f38ee3e19a4c1006d5541773bec11b9837a83d177ea8cc81dde9acfa4b19fb1d51eabafbcd1070a4a4fdf1571c30d39
-
SSDEEP
3072:NFO8FOuyitL9pJK9SaYSqMcaSHu8ehsiJ2YYQ5p1PswvKgC:EeKIRYYQ56
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b97c5f9ba7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{811A29D1-138E-11EF-8414-4A4F109F65B0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000630b892f154e39067dbbcda04bd07a40acb14bed23b2d49f7fa0a83b3e260a26000000000e80000000020000200000004d24f58ebf81f2fc001c8ca43e32e61ee0f6f2c4f3c7e0c3b35358b5bf646d3e20000000a7b7fc997b2fa3cf1f1d351f2a3143d6bf89e7c566b5a42beea41e6f60e0f11740000000baf483707307d02fc3f8933cbc6e0af32c349bda05ded70d862298463c3f1cc01d3bf817e01b639757dd156b06f7f38cf230618f9c6008d379493dfa45633636 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422030692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000079813ccbab0b4cb3fd659cd0d36a05565baec98aecdfc9b84765675d683e3148000000000e8000000002000020000000f824c4344792458fa3a5b848524cde840232b0eeb125388bcdd1fa00047fd338900000002ff9fe898bfc9541b704f533e68d9fbe4d36b07079a0796a7dcdd4d033fc8d15e7b4c67cebfc139bf4f116b219672eb37b854e27332d673163dc0a8d23a320d459aef75fc30041f72175c14399db84600dbf9745a043c8c453468c43b66b5f398c6c24efe98811786f24744d93c98718ea39c6b9f418266f6e84771056ccb711e33ecf04f578a725221025ded972580f400000002f3339c132933c7ece84cfdfb32b802bbc76beab5f32ecb1db5616fa8952f5441ecc17ad61479852423b00720c0b41d55c2a976c5b5945707174cfc379cc430f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b7d3e4f2ef3810a45ed4a7cb72db092_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9f3b1cdbaa4a8176f5c8ec3249a70eb
SHA18518b090184f2a2a29d7d9de9b9220618296bca2
SHA2564cd28f1b70049af72a7ab66baa3f3cd31a1511f2e9932c05e5a54b2a88901460
SHA5129d24f7d128fa8a6ed701d885566f8b22160534b891f778350445102d24efc707361648a91424ab03bba0484dc10cbf2c02c09013c431ff0580b819e1a45ac384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5864b0d6b0a04b2de6aeaa41578b109f5
SHA1fc35b2acbb39ea85e89e4074d5b8325e7e3efe6e
SHA2564eeda9aacba65406863870445f4ede7e48ac2ccadb38ab270a9723e720be69fe
SHA512bdadb6f83b7d693247136bff256ea2366812e57d2a131d6ab843a94c4bb7c8cad8be3626e2ce18e502bb4f072908284d9742ff750602af3ecd6223062a4aaaa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d4b09e8fa1419434693f92360dbbb7b
SHA16c3e05eb95f46ba5c28288e3488bb31a20811d25
SHA256e778883f9203d65f3efb03ce412b80fab7c2e21895ce83c291aaf8e1f1832ff7
SHA5121b4fdfb993a5d95eacb539880c84466126b9eedab73f9ee4f84c493ff30c9c9f627c3f3c4074008c1df57c79646e9dd73b6ffa7d12dc183d834fa5f315d8d728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54584f667120796101c88a41a4e9a1570
SHA1a787919e7a9b840f6d1acc89422d89df85e16839
SHA2562dd5101aefaf84743819ecba30688ab6a5176826d029583a7d85445b2643ad74
SHA51239c5f2bd465b42cda37cc0ee7002bf213842c5753b21401fe4368fe75337954e6fe9a9f2e85234a1959db5ff1dd65f2ef1a159c4f524f4c79c166a616afe704c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c12e582919cdb64562a0da713978bdd9
SHA182573ca5ff92a7d47762712656af1dd95df6f88b
SHA256c10ef10369d85bd8de5f2e0552d1c5c357a40b6fe035b2b572cc5c1ad261048a
SHA5128986fd9fb2830f6bc9c283206c8ee429039bda4d99cfa17977a78963d4784cda6d17f930103f7eb26c858ead444b6bd0fca14c7e902e48570ab44071441235d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ce08561e4827fd03e3dbc963d56f117
SHA1bd5c6b9192f1f2c2e273be3648f4529b33d984f4
SHA256d4a215cd7adb537d1278b4b906373c16d1e35736788310be93675eab7f141a0d
SHA512d6203c386709e5325cbc65879ae073d4fbf0e87bb72d0a76ea60b79cf6424469aabbae128c50893aa591772d5a13f25af20d7b597a31d0d47e62bf926f14c722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b05cf98162ef8e8b6df0e0501e4d3427
SHA1f59f455a45cb616376b3cfb9b142391304b9f4f9
SHA256b5972d11ba0da2d006aba8df59068a049b3819cfb540bf32b6d874e8411115ce
SHA512cf1eaef8457c7e1ad8a089dc1574e7d52a31b106b3ece26196a4454dab07afe26c6399fefd46e21af508587acda90b0f1ed5fcedbd80a8cf9d09679558f54bb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50284aa85cdc150fd2adee081df7e9555
SHA19501607b898d9d85b32f1815a60cac4141fedf6e
SHA256b3ea45c0a4ddaa44152150b68c9d53ec472e6dcabe3a7c7c20f56bad7170aa96
SHA5127d68b5803b57a2f2fcb27ea905c4daed3b5a92c6905d46753be539b389beb8bd7851148f24723930b5ba9d371b618ff9bb1f17d6a0c7e541a11e4c5b5c5cac2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8f8a16ef68b141a941db7cf83a353df
SHA1e7947861530774bdf9b6ace46a8dd51a9c501363
SHA25630e7288212cb2e6c0efd5b2b71162d76d835fd55bfccbbb0813d522076085dc3
SHA5129edae49f569057dfc81b070d430d0f37d11521666a22b0bdd68d87423eb11f92898c002ff67f258d25420372fb76316e87b4f72cf3cc9e4be9495cb20d5ae922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05dc3b9e9560bb9689b3e17024a7f22
SHA1241b633995c4ea549f1cd0166e79c92fe693edf4
SHA256ae49dfa6c59d6d8958bd4e12103af4729b85fc4d19f5a2bee7d8e02e4ddaec96
SHA512ad17eda2e1f7bb16741b9db58bfaafd441f97fed96edff9bdba13c55b05f78e7062979efe7a1bfe719783a758b908ce17bc2a7c5c6eb45cb78c078bb91f63ab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52665cf8cbd5d0b6bd5cb5e40f0d0a9b3
SHA137b89cfaea85a7d62336251c3d6437c93eade5d4
SHA256892fe944a8f745427bade0b9211a8adf728573d103db5de3f5a7a5a00bc10439
SHA51261dfb6d4dacd2d2a5321eb90704a091e116c28f395816d320270279868a77213c0e2c0b7648ce9e10f0096f4247892b3a21e920c8fcf51f4416dbbdaa3c25565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549bae0b42f51f791c3c1dd630f0cae5b
SHA1b828359a89f934898bc120b8648e82a55068bc17
SHA256412724207f622f2972bf1c2000b021849ef3281c46f21347914be9d6a7ff3867
SHA512b4d6b435e0a59820cb0ed5871b7a18a558bcdd77044c5a53f79a496fe8695521d3c4e5d1a8e67276d8abb5d4f6503a6f6cd8d282b97e9756f5ca6404308c1818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9eaf763492ca51e9d1faad823e465fa
SHA1fffaa683c3826c65d0d9254ff796bd88c652eec7
SHA256811cb7bea991a2f6f913be258237af14ac7865452110ca6afd26c821435b5961
SHA5126b54a9666fce46f168d980a9a67c4f2d3ad3f6ece8027ec9c0190a091b79e3fea34f67a20d95e8116e4d43531043fb6b20c47e1b0277fdc51c16dc9f577413aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3aff105ac59c350817de2fb0430e8d5
SHA15ac9d0d78a42f0cf1b658f6ea3a42405a6113378
SHA2563321c34d751ae3be04fb5eb08d951f1bd6caf4f9ed6f1d252f5ae19afb5724c0
SHA512a1271881f9e4f86913f01a036e2ed471a2943af7cb0ca4fa911b35a5d6984f44242955dcfd6d9589b2a68396639d52ad0dee569b0b2fe5687bbc1fc839f48126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e166527640a93b496371b3c874aa25a
SHA17683d5c83d9c39fdbddcd6955f0562bf933c01bd
SHA256d3b3d5788497878cc4af962dbd260ff08c0f32384c9a7569029175883adceca5
SHA5121452988ebe65a61e60a98e64f3035bb035ea1fcec1b20d87069502dfd281afe681e2eb003c7070a0e819964bf90bce44c51196f9cde8a92f102d496a6ec687eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de39f50c60f389663b2bd55ca96eb8b7
SHA153fc0168a112ea6aad590aef32d9f1ba720773a7
SHA256daa47f0f24d0cc7c7332d46537e926caa1e36a91af9754d0d1ca3100af68d1ce
SHA51248a2c67c0451a57e39f8b85a28221b3a209179218d4520805165f67fd409bdabfa27cbd2d364f6ddb0804b032955fdca3c4850e9f791a89751a03708adca879d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa5ede564748b4f09f9911cc899600b0
SHA1623f9031666e1ccb21c715b98fe39149ad58bd5d
SHA256e88964227a576723779386950a5d839bab4545818c1989adec7d20eca9adc678
SHA5122848cca90cdd26e57758cec04dccccac0f4078b079819ce7d63ce5b53622f95e1123b4f2e6a059539282e10ad5e7ae2d43b99b02a1e178ecdf0e724cf142cd14
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a