Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
4eb789ea8d50416e5af096b98bb37f57_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4eb789ea8d50416e5af096b98bb37f57_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4eb789ea8d50416e5af096b98bb37f57_JaffaCakes118.html
-
Size
4KB
-
MD5
4eb789ea8d50416e5af096b98bb37f57
-
SHA1
feb600a991240e7f3e2e7bd6f6879b83b7e40b0e
-
SHA256
43b3b8b39e4d4cc5f69ff3762e70a38c2cbaf6a09ccddf8cb4cb4a3914928c6b
-
SHA512
7b7690cc327170c5c62dbcdc2a9776de8dc10e2eed4ad5357ad122f9f501cd53be4ff677186a654f014855c2aa4c9f85a7ff1af2003236001f17a52e06e8366f
-
SSDEEP
96:Pk7hJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1d:Pk7hY1aEFHVKtF37sNjtXATIQFM93pDI
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09347fd1fa8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28C9A321-1413-11EF-9EA5-C6F68EB94A83} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000069dd12e89ef3bf4d8b26ca99d5a73fc400000000020000000000106600000001000020000000291280e4bb1e2d0f4a7cac5aad0f01bc701f6f7344b6baf3c9b58cfccfef1bbe000000000e8000000002000020000000c294945a3c0bf9b4ea3918a633a4d96102046a66d3dd42cb8249d4a1d1e01264200000000ece07c24d4203ec561d8c9022092d27fef55bd5a2318586acb4f05379d24caa40000000cd17c0018a1ac0680b11482f78aede2b5e464ed3d39d22f892bfc12dab518872882c26dc623990a298f25d14b03a3f57a710f11b15a5906b3c8452d34a7d2244 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000069dd12e89ef3bf4d8b26ca99d5a73fc400000000020000000000106600000001000020000000ad6f582ccdb1bb1ee78c11ba26165e706f2e23587ca41049cb2bd17b920ce56f000000000e80000000020000200000005e60c0d26acb208e2134fb549ec01358cc30c2394a3abecd74472ead922245f390000000f5c382e444e1a047334eb406cd4c4e96e902699058d7fbfd4e5b71ad6c9cbaf279172ef2fc68ccbda24073421f43dd9736875df2a2dfe9807c10c9fd38dd5d43c23d06f0f3698b7b7669f788e9b846073041faf53e047d1afd66139a25d13e202de29b0ef6359bf16be8e5610edcecea78c3590ed0f3803ffe73cebd77f1e644baf382a3dce0e575e4af3bc0658bf98e40000000b6f15a70fb6ece741d74a80702d5bddf87e4fff433545ce76fbcdcb1df80c313194fd5b5f1d9934d59fe3c97521a3ef00572325c5f6f9c938048efeaf674b8d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422087667" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2744 iexplore.exe 2744 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2080 2744 iexplore.exe 28 PID 2744 wrote to memory of 2080 2744 iexplore.exe 28 PID 2744 wrote to memory of 2080 2744 iexplore.exe 28 PID 2744 wrote to memory of 2080 2744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4eb789ea8d50416e5af096b98bb37f57_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea820674c97457670e59e36c47d091f5
SHA1c84a6cf691fb84e5663e39c7362ef4fb2ec2a7fb
SHA25645cf2f5f0a6ed236fc72dedf61426aa0fb8a3b10de3f2e7356c555d83bb49855
SHA51244112b321437143bc56a500cb35f783b3e010cb2acf93f4bc8a2f17fdbc0b5e82401e62db864deb52f7215705f6a5577957381cfc7fca8f93cfce4cc07ba8f53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a88a1e480c7a6c08a40928d5245d796
SHA1714027e9cb6e90ef3defaa1601d8296a5b241622
SHA2568dcc05ca5efb0de724b31b1b5b78a6a366fa05ce7bbb08b8abd5e8d720f3f37c
SHA5129a9c4e580419ee49c120c5d4fffcbf9b79d93f532401cc9d38d169d0945209d523dff5b8e2d3ebe13ac9b2e244588b8080e3b139d06a51b74135c548c297982e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d1f779c15650e07a3f002b8fb3eed57
SHA13b857f0af88fadd819d1c0ce494d5d8d7f1127b0
SHA256f09bc1e8acd093cc359b92516f5a96e33e9ef2c002e64c1ad99fe6c4c25b8d21
SHA51225d47ec7414da1bc024e1536ef3f2832d8ebe77fbd99ffc361e95bda2c12b75d92f6f447a7ebb72d80c7f932d9c16adf1240ede6597802c3dbb23bdd528e6949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a54fc1e3486d4edec115e4fffe9c2e02
SHA195429ba514b22f282308e066ba74b7e8d3038849
SHA256082496bb115926aab866e3f489bd26074045628e2334acff20b0f386928c55c1
SHA51256e61b0dd522662398d39cf0e7395a73b6ccffd055ce77f152382ef9726ebfd03b1b5b58aa839647545abce552f88d1de2f0541081ca271679b081fa6d74ce06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de9cb54965386bb7238c86cb722f3a4
SHA1478b73624ce5e57826867ae66a91a37825907663
SHA256651a6b0b30d7fb84c37dbced67c20beed0333131eae923ccbc7125b5df1ca1a0
SHA512de21d37c1226369b0fded70620f1831878e270a4721445b71b85b32a2548b00450abaf2e13cc1829dd69168f4344a2aa2d192af01acf21a5f060be9768926ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582f1667f4698fdb50b68cf98386361b0
SHA1bcd375980874d322690a973222b23ec38b970926
SHA256075a63d9ac877453f2dbd3d98a9dfead16ad67d8f81fe1879e674629edb47ba2
SHA5128fe72204419074677c0858a7b464413d395ea7c1d4c321df3c7672c93cab2cb2d42d3013d57c8341ffb191712c4d18491f6d8569d206ec6cf72540af879c8e10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a2e893c464fb55f0d753292a864bcbd
SHA119d57905ee508f0fbabdc5437b9ba5be8696573f
SHA256b0468b6ac92a36758ed2a75b0c5c83734c6e21f6477dec356411e9b8728fc68e
SHA51298c050bb3c578cdca002b424ccffcdd106171e4fd118297fd98630611a799865393bae8a86340e6d3d92a90049dafcc3c3e010173a28a37d087f4dc12aa8dbd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578768eab992f3bb697a43ddd0bd016f1
SHA19574935c1fe5b67b52d74e62b5ebdf09a99fcdd2
SHA256bb92467d1b6a907b313658625221bb9e3bef580f5b932a3efa8c8b206cb409db
SHA5126f09106cb39f077b628e9f0f485524348fe8984ff5e2c15e2721e8ef8fec1c0a1b592d10c51b445177d4631ed79ca279e42888864e8cf33221dc21deaec23fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b94fe45768cc8a2d5b778e45a87dc80
SHA1b0b69ea8ccaaf9f8338b394233a74cef929846fc
SHA256ed355b8d9cb3e81bec5b348a02c8a19bd7587fce2564e9c3c010a7b9ae297e8a
SHA512a04fc6e8830ecb73d2b58e49e8673fff8907ca24ad178b14c4cca594a5c67d56ebfd668b3e0f77a053cf0e22aa294eee7f9aed0da456b313e6d49db6e9a87ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534cbad0c0a8c97420909aa2cee933c9a
SHA1ba936af16882b4e82b43595f7691ded768fc4d61
SHA256b238be30b5e553dd9ad7f8ea977ba7c8872e6ec70ee6f9ab0489cb5baa1a6dc1
SHA512651217c7925f256431cff72111cae11e4db1f0909ce662a7986e53d226b4ddfdfae2711f2a33aa33134dd4f768226897820e890f727d491d51a0f2da09a5dde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb34c34a38762eb8514d35484d8033c5
SHA1614fea9d39f7312fab6f1948ac520495979a3d20
SHA2568a12ab04e58d0aa2481395c4624ddb4efc2d19cf7e81019e04c7c3edfd2384e8
SHA5122f9b60b5c2790fbed47877f2596e43bc920db8c99e6818d74bb63a94fdbc0076d4ef820cd38d22fc238f8695283fb592aa3ed3ef8649401b027987e30dfc3c1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573498a2374737ad7175ba952a2877f75
SHA1a7525bf090cdf0d279eb6e89ec87530f23d6387f
SHA256105d3c8658b8eb3c341eccb408e22e286ef0c371641fd16aa9a06c59b55ecc29
SHA51203bcf2ff2816ed9f5afc62835c11d7264c99c08da33dba8d4dda0617bbc6cde5e2e745cdd069684048f41df713ec671d98e6e72939807893ff6ee6c77a3e6272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7c9781bc177d5162e694958e14e3ca7
SHA13074f6da8d6e2d40abfe40b820aab9096a38968e
SHA25662c556d890ece90348d0e33dc7c85982adcb35b6b973166ddea941fe0ebb4c4c
SHA512eb0ad83174e9008baa8cfa79a3e77b476a9f21fc737650ef5011d7ac2ae4e0d3ad41989fdc1c653d3f3917cae9a23a0d2603912a67ffb0c49dfcb927c8c3f4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3d4906333d82b843c70aa97a4fe4920
SHA16804643e0d6e957d3525e9469503e03c17a37bf1
SHA256d16602c65f14b61cc43a55c64534ed07e524dfd3674491c4d9fa1c94a63d10aa
SHA51299cfccc402ad844bbd1028f41068f7d6b439a6db85c5d2af32064483ddabcf9ae7c8f093761091ac422315434ea78a54c845963398d6af6a0d2c1e6179687e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532a1c0d07e5a3b63d4a8f0f55a002257
SHA10486bf8611143ba0fa0d3ec908f8f47e89610320
SHA256af5a5419dd1e2f08021eb57e1ef18cf1dff881b0db07cfb433def23e963f2542
SHA512cfcaa8c2dde6bc06dc6080b678bbfb1ef74ec12615a9f941e3f862fc56ddd3f6fba356954653aa33a406d460b70fa8d2131f9c593f93c2bd6f7425d50166595a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea00cfa87bd4c3b5b911fd55eb481f10
SHA15b2e4e849a3e83eec94de9b07e020f479d02df3a
SHA256f0f143f59980fe7a17857de11c741fa4ba7df8e56c83e8c3f899193f74f6b3fc
SHA5122e9f93e1dccefa15bc45abeaea68a8875cb164cce035736a6f4a04a5bff2956f13c91e9cbd16536500d1511dff8a31576adc29587fd68eb1ede74f755a02cc61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55546d6a03d35376cb52f35b4e3489f7d
SHA1a8bc38098f9d7d6e1c5783fcbede22f88994ea51
SHA25677420183238f449d14630e2d43920248a14f12fc3a3c9d708cf43b833bfd400d
SHA512e36ed0e86470a7dceba722191301f86b4977389bf7d2ee5d53d81b5a2d198a74929d78d8fe8b08881a4e0e9e273858a18213734d487c9e11a67b75cdd3dfb19e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a