Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
4f1cd42e4a83b77916fc2648b2dbee8e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f1cd42e4a83b77916fc2648b2dbee8e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4f1cd42e4a83b77916fc2648b2dbee8e_JaffaCakes118.html
-
Size
460KB
-
MD5
4f1cd42e4a83b77916fc2648b2dbee8e
-
SHA1
b5a05cf509510aa164e53c6d19a20d2ba7743f90
-
SHA256
0997bec188a1559803aec5f336680c986f827baddd4b67f910907197925cfe64
-
SHA512
d24a0251452fca4f511b7884795846574e2fb5290ed1acd731a6824ca0f9721b7e5eb718a0d452f5194ae35fdc1bbe7ef3fab0f8974aefb180efcbce13ea442c
-
SSDEEP
6144:SesMYod+X3oI+YKsMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:P5d+X3S5d+X3f5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6F8F591-1424-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80167e8f31a8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000576bfa653d10f848f3a638cc4b0eef3d49e7ee9c88b59c830ccb3d94d4fc4f9000000000e8000000002000020000000bd14c7ba3d3f43412cc449a39866359fb5629ef2b9fbfc10ef66d6e6ec8f0137900000008a2da56b9c9308a2e162a8b9b83dc8d278cbec696d7a395cb9a7d2b474c237ea432ca2ab5e5cae5aee4c3b1539f4a1f33c65baf960e9579e48593b26e74f90f857c077df14799bb19491cde84e19faae2fcc17bb6aaa42a0ffa79f41338229e2a83bf4afd64282db49ca2a05183fadba955e1725c2ed68fa27084972a50bc33fb698bba2bcdd469cf4384118c69709df40000000d954a9f8482e7b34620294847d80b13171409055debf80e9b45f558993970b2438532e44833e542eae1726d9fc30ca576b0662b16068e44ac4a8761071885432 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000044e6245d90b2a8ef1e2f0ce5893f2e6b9f79ee78b543c4311835f693f19bc53f000000000e80000000020000200000001d46ae705013f2f415426a13fa24b8a91e30db6583f1ac382608313267d157a42000000037544e5377d358f43416a4912a1fb2d79c8d4e6db5c1f1320004ec9847f840d640000000d83bbcfc71fdab3bed8fe4d932cfad2eeb885cbbd2956518b8e8e31b1cffd2a3c8122ab25c6ef8b1b343079859e46389a522b93917a83327655b6c814b14ebd0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422095206" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1872 iexplore.exe 1872 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f1cd42e4a83b77916fc2648b2dbee8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50752936bc68557c77bfd7771b608f627
SHA17e799668aadc4c50d6d705ac483ef28df0a9ed37
SHA2562def9671a2df7f81a49d74c14deeeebce2ce94e0f00eb6feb8072c1c928dc784
SHA5128802b5779fc74da3fee988aafb8e080ea3c138e0cee4c8ad09390cd75c7ed6acb5f609696f9c475d964d9eff4bd2cf7030a592c69adf2a477d5f2988298b9384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5297b85350f9236774bf4f10fb865d04a
SHA161871831c7899fca88d61f8cb312f6bd80113589
SHA256fd58e44bde374eb13703f1fadce3a292800e9ca914c26600958ed26dc5ed8fdd
SHA5122d89bef7698dd19a516e951fad98fc21b0ef4e57ef7698866acaf44c58ae0d5bfbdd16c00c2b80736496357e0bbfef531528023e7f6a923a3e5146beac7cb012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5616175512d23a1183142a79db6d29fe9
SHA1565d28a80fc2a5945468ed1cf6eede906c9c2a00
SHA256ccdedd65c41665dc1d9f14ded0849932e38da010a9466dbcf229cfa2a46b345f
SHA512f6c4950e7456740773b3ec0bc1713d6e246c343289f7d7a38f27507aab3df65ada6b5284e828df03d360797db48d98356c4d14821ed26e2f17d49094ed23ee52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5187650c105bf2506a04b3d88dc4dec5d
SHA190de4dbf7904283479f4d593c54b441d47ad47ba
SHA256baf672263865e8f831e1afe39ac2e1d43797161e39845ea3d22edfda36af4780
SHA5128e6c6ea650e9a7600de30e10b83b7559b14fe8c1bcdc548fef7279584662a521ba46f1d4a8f93b531ec8e3a1335582a9a0b9dae58e697ea666dc13daa17ca962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f98fa50ddf8a28a55b44b6776da31e
SHA19cb9c3da991689aee86574b9e0f99f3d30c1e558
SHA256941d85824bda10e3a8948c3ece5f45baa735d68b3d8603adda68daf4cfb70c10
SHA51220bfbaa533f579e6720afed1e28d9c4fc7667147f6306febc242ae5da0c8d9b2ac3e5e95d7b2fd557eb9e316b2b04e05d4902357dcb34084b545c6cbabe63b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dbcff414b82e367e455af54fe1283f8
SHA1292d6299dca8cfa4578a1f86adc970ebc3cedbc0
SHA256e945b78585975ce5019c8c28a3837eac73812c985e36cf5c9fe9e8e3dadb1814
SHA51224ca45150eed9280b13a6a04a5c3aa6909efbb666946887db93eae50e065bee1c969243ee5a2ed8fff37a6312fed9dab729c5d0519afdbe322893699e639746e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de94de1015c01b60266174a0018fe96c
SHA17e05f21a643f1c9b01e4a5ed5e4040fffee34bd8
SHA256618c5fe2292dc274bcd20bd80d49bead365b7ada2a838761bcbfe15f1c9ba8b3
SHA512e59d37306160967e9f348ea970a438af62b1885ed1d2201448a86469b4fc6c9c79d0ff20218615efc50eb4776a76a233a47de5f896a0b830e1e5b9756fb06736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51817ddc537e1b4f334823fe55a2db7d8
SHA1b368825c2b65e3d88703ada71afa21c8413044d5
SHA256cc2646319b5a87b9b2e4ee2f222e4abeca5e24869e253bda4ad8e5b82e57636b
SHA5122e2b165e2f6075b8e8608817d5e7f70e3425ec84c821a59f5bf3969dc66daf573940607df60947930ae734013b6e29fa7a214490aeee7c2ade6520aae0cc9e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e684927fbfdc1fe4ec6ff3738c4b6b95
SHA193758fc570b6ba64233e60904970f32ffa8688ad
SHA25609a05cb31c7827c0cfaa1d8cf3581b13203bfa6cde4122fc5ca3a0d12b86d7ab
SHA512fe2a2260953e69dec933e7a0e58e3199a59841b43193ca96d05018d066e00cda685a61e16c3fd397e97fc7e70de6e68c8c72dd82633d04e8ad50fece8e768a18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5729b2a531f27b1fdb14a483f9e1f0bfb
SHA124d64bf00a5b2c7073835abdb584449c5bdc60a6
SHA25611f773f30f4de7c16db724e4b164c40f9670abd7871c481a1f469b4db1477fe5
SHA512a217891291c0f29e807cc7d836cd88e2bf84043f7c2ae0bc703fec4be04c804f45f9dba9a3fa111d5dc1e53acf03d63034695da268969d312000447fa774acb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e2c1b953c84814a62a132bbee25a17a
SHA1c797adb18eb0503f1abc5c3c6a9cda7b98cf1c71
SHA2566580e73d0b3a267d7d0a137ac94135b69530d7a87032d0051a1da19eba7b5b47
SHA512fc9bf1f5a9f9469ab52b68da03f5f4b76292245d10e45c63dc8594632e08341e4f547b37ac9d3409d51ec4c95dca6e8cb9ec663e46c5b541be2454b12e5cf3f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b45d9bd54c05c172f6e37a0135efb1c
SHA119a865bceb579a4d7c802b00c235fdb0a45eaa5c
SHA25639d9f37e014a9a5add45e73a7485db2d92241d84fbeacf1e5df681c8dfccd35d
SHA512f96e5569f02252b22e8a4f857cf2cdd8d6747b23e0397f450da1b1a85cb15f06f2123d37e00322d729ffbf5149146f16ef6a9bd1b16d11408e7ad08ae44f340f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549b01d713f01eb10298af4077dfa3bb2
SHA14151c836ded1c08d624702adcf8a505c151ce399
SHA256ef6cab7dcbeb8c7c8fc5858b1fcdaaf73c278b530080040fc87da8cd9d97584e
SHA5121b8e2048019fa35c7a502544a4c8958f4355258bbde830a5ad821a9c718eb6e8ef700424f001d03e495ca4586122488ff3839dc66a38565b21cd69ebe5b176b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f30ce866b618d7998a01180f8cf9a2a
SHA1cf0df166f99db20d86caafe39d0cff418cb5aa56
SHA25620f9923d26dbffe39ba80c451a430b16cfdec75f9af5d26f276bd600c068dc5f
SHA512f3e741c2f9933849cbfd90180c27bc586fcc0092db43cefd1af0a8b5d73a22ad6ccc35e7fb987bdcc1e74564fc9c93f19e19869762dad149228123c49dc39a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c2e1710b32d089dcf2f1499ece73686
SHA1b1973b40ca4084b59e9f695fd9ab462c1ed003c2
SHA25621f82155a4d7d00b8fb663876ad20c248edde05279bb8e89fcdca4c90827d742
SHA512f349c3e8b510bddb59ae690ed3acec325f88a2b0b7b562bb02a0fb6c33580c4773e7d770da5540f76a2796fd47a7a90fb80b0657128fca8b1dbad52f1ca13b6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf168b52af5806163c32833392e4669
SHA1a7fe5632e11c2a9416362bac0abad76e57a34859
SHA256c6db0f5510f4029c42610530b181da2c02aca7ed626da95c70f0ccc8b02a36fd
SHA512552218ffe2a90f671098355b7d744b81d659663ddf69e054ec65c2bcdd101926baf2821aaa01adcdf9680f35563464fc0063c53d2594adc6dc86f22adf967eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ddbc6f73c559c41999917804671a9fd
SHA19be27fc8191e9be7ed070c91657617d4c22eccc3
SHA25611baf5e012e1510390cc29667fd22dc9813c56f8868bf902cc801d464189d9a1
SHA512320914cff2d4a6b9b67e0cb1221471caa68a6909295449a3534a1d690973ae0159c82978e354c6e56cacd00e8d98658df61ad27a88c93c424474a5fe5bc0b4bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532a7baaf3d3502e4ac71721cdd601b36
SHA1303999cbac758337ea51176ad53e762e2720f021
SHA256161df6a690c21dd95998904312e46bc5d5dc482542fb718d1b7e7ab28becb8a1
SHA5123c0f8d519a9084c78cd5e8ebbfb8244d7e01bada034f657f0c3f189ea68571c9730e8f67a7c3194fd7df139abc74661d41565e7d07db37c7982d6fc5d18ffd0c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a