Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
5e43f4f9ca49b99adc0d3f4b8b33d4cd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e43f4f9ca49b99adc0d3f4b8b33d4cd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5e43f4f9ca49b99adc0d3f4b8b33d4cd_JaffaCakes118.html
-
Size
28KB
-
MD5
5e43f4f9ca49b99adc0d3f4b8b33d4cd
-
SHA1
c210b9790f6be60d6266e4fd073d016b7997e25f
-
SHA256
c244ee1342b02add887ad70aebbccad6a9459726cb324fea8486785d37dd6766
-
SHA512
cdb757e55785e5fd9bfea52945fcdf1e23c5e50e053d979fe5f9ef3126fb5d7f5d4a83956e8fae051ac18a13ea352c0fc6d2e88500e9fd53c01e78170e070a5f
-
SSDEEP
768:Sfa1aIOIi8Toerr3DMNuer6zR5OBR5O0ermjGy/hTRQPIUQsgVY:SUbi8kerxer6oerGQ0VY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422357831" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000e2a1345de0ecd07e370d885b550bfb5bb3e1cc51c28525ae30eddf38447630b3000000000e80000000020000200000009cddea33f19b39725dce968d2971f50e9b58bcccb6be572e6002fb15bfe72eeb90000000516097752e32659fad2f1bb369203499ed825a0b48d1bbafb2d9182637901024bcf42032ce0cfec0453ad47c71cc7bb578d3cd9cf4f25fbc1de81f90e0c553c1ab163bb0b879bd42de9c0d966bf00b01b12e46dffe96a32045aac708d44a9891dde5af6ba6246229e8695c786c391d82c3d13e8c4506984473d9257811609148f49aa5b9f9857b259ada9a82ba3beeaf400000001d41081e5619337e916ec9f76185240a294c0a1aa516c726fa1d3b87d1081286c7f75d109e200e1552f95906d8d0adb5dcf9528900bb726ec331e4a1f542505d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E7F9FF1-1688-11EF-9C17-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e4bc4495aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003d25b8e66df321369258407506709933092ce7b47035fec4048410bcda8e851c000000000e8000000002000020000000e8cee13faca29f0656edd04c44d17baf8b07a3cd376175a9f66287d435337ac320000000e0cff53bae2a8a673d783926fcf195548f837554d296fcc97fc401554ea434b3400000004c101a60c213d899bb5cfe1f1995a7f1a6994388e14e3687fdfe2e806a13207890769f70923cd6d49297a7ce33073891d758d02cb0ceba446ed4da90a6365db3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2228 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2228 iexplore.exe 2228 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2924 2228 iexplore.exe 28 PID 2228 wrote to memory of 2924 2228 iexplore.exe 28 PID 2228 wrote to memory of 2924 2228 iexplore.exe 28 PID 2228 wrote to memory of 2924 2228 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e43f4f9ca49b99adc0d3f4b8b33d4cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a7885c346f6aadd08da7d3a197a461
SHA176ebda542e0d38fc0405d36d1ad604bfb33ef30b
SHA256dd154571bf85b3f7496f8848a6233a1ce29cef5418804377a89f615bec9318bc
SHA512a52b2e220d9c277732689cbc828f442e3c1391e45cd96811076bee6b211958b1959a69272c7e99df17c330a5e7e5eb5dd59bc266621566c4e255112176928bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3c09cc0058d621134ac7110d17637c1
SHA1491d473a328e226337eda0a22ca6ac158da9efdd
SHA256f41180b7afb382c83bcf72309dc2c3022ab63c351b8008ca1dabcbaa66488632
SHA51233c071c5ce2246886eb3578548d77edac75d3d71cddad7372f01bd93da9866cc8ed0ad29cbb00d42c0db15fd13172b8495bf1d18e082c1caf89c510c9645ce4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a26a8cad1008d1bee03a799dfcc892
SHA17d9598f18e98193808d6828946553fa067c02586
SHA25693bc7d7869447e0dd0a465a24f30775d62aa1b4ac75f5e4fc65f5564184cf42b
SHA5127cbb0bec0da72b6fe9893bb7ebb2fc02b8815fb384178e78f19e75ff423be2728cd6b64d06d776da9d62c61ba199f9f5e1ff5950119cfc432b7cd5a8780b9ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514f7574ffcd8279d35050294b1ea78b1
SHA17fdfbea3327769dea8382b5bba6a3b4ebb95db4d
SHA256a1c433132fa08aa28cf7b79d235e12447d147314009ab7f6ec0f4b096eac2de6
SHA51262484011840f676309d4dffdeb31331fefeba9f13a27934518ab9deed5967180d7e890d823e5d6c183c61edf0782be2ea898cb3ca037550fdf5e3b03e0f6b9a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f8d6fc44a5763a7a2cc8a040cd827dd
SHA1f98999b23b681eea1801e430aaffd405bd0ab3bc
SHA256f34dd30714ca0875fc4357bac12313ad1ad5865dc35209484c99020b2f4be3a4
SHA512698307a8b98f86c5ced4d49df09651a702375a857e574e8d7409c0949318c3142706e99f1fc3cf6cf9c01b7ab630fed04fd87942531142f879c0d34b8b473326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8f1c5812fa5986606fe49235dde2d77
SHA1de1645dfb625041a7f93864ea6533c93bb58a43f
SHA256ce0c9623d4662a3340d6c57fdb756aff30e63fccd342b6b51edd18aca418b64b
SHA512966db0c0a5f2f4250683db1a6b1ff5e943409f329ad5fb4ca1e25178519b065ade9a5dac33a2082fa2e344f00835de3dcdceed7d9aec26c21a1adcf5d679439e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e888db6d43b423dd03ab4aab1496f555
SHA1d5752c9704ad5e05a9c2847d9cf0901cf4a04b51
SHA25631c34de736d83bcc091d5d916ab1bd34d7fcc863d36a89e29d9be601af671c12
SHA512b4d327999116533eb4f9cfd212e0e331611a287dd83a786170604cb7328dff5b9cc3ec3495ac103ff0e3b808bcd0d49213a57982d6f3733daf9382a66f68a929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a040ae0610d5aea10347909d2321800
SHA14cd8db2a5deb0f98ebbf294e1b2cd83ff34701a8
SHA25612de2415292dbee1cb48feaee63714813985b2d8fd126aef687879dc122cd19d
SHA512928d126e8605080b4e091ae0b685ebf2475ff8dc4d4ff10f2f3a244186ede479a9cb14fba3c29ef9daf78caa960d442e28d28103208857c801fff7acd8b329c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547930842ccc70b06265096a87b88f7f0
SHA16e2528bf52fac0a40af6c6cd1524d8e56034e2d8
SHA2562ac9c7c38d6494dbb56d42062e0cf20cf2806fc81fa07635250590105be9ebcc
SHA512ca58e7741d15e4c3e4d53efc75f0e39f9f2a070ce66982b7b8f25f711698fcd2bb840fee3cff7f645142c60e7b8a127cc9fe46dca3a0cc5d05814aa063e72ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518f4a1d92af1b41c487ad6f66466dfc3
SHA115c28c4295f267b701ad479f9e40b5bfaa36beda
SHA25647618a4f54ff119c1f88dae82c46b60cfb7c9e4d4a5e336d2cce525b9aba895f
SHA512f02666a079afbb831a1d93c1a91e99e6c8772d35cdaab0ed3cfc3d6800d6a40a9b211147a752172c7e67e5ec47809a9e684c6040f490e3646a52921adeaf448c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed324841b3d1e34f729e40a0b18a3992
SHA10dc5f515c01cbdf7621e85e32a41ce1e8769d9b4
SHA25664a91a12ce249a7edd46b35800b3ae8168e402504d8da67a6588b18eae758c24
SHA512f5cadb55bbfc66808fa877601bd07fcf0ebeba194a165eb6d45190b533b9c71156783482d126dab3fd3ed262ea0ea4cb7f08c94e86233dfdfb548f57b8634958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e59b2d93a49ef88f7c9e30f4ccdedcc1
SHA128dc8e80f53d17fd3e24cc7ead41d8777f2a9533
SHA256c82c370339f05c659c6e5c67d04b6b5a37f952d6a58fddccd4ba6a8f06cb461b
SHA512a1af933199b171a1a4cc03d287309a85a49e25aefa199312db65d937658653831283848333dd4719ed8163afe066e5b5160e6fa149977e0fc0d579b29c0aa339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539d1fd7e47696a16d9510774e2f0e2fb
SHA17588daeeb2b7e2dbacca0f14dd5097d3e80145ed
SHA2560a22a1ac14f108fa7ade0af8d5f4bc449e6385e669949f5e8d354d112eb05b1a
SHA5121be5639517a3c2952e5d606184afb2256b2eaef7fe76f2e08a5ecff396320d315ea8bd78a4425e70f42e4f10a825f4c6aadc6fea3f726c7d836ef6669a05f5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6d619c741de6e211e07e06101f3b646
SHA1339358e740f1a76abf4afb1ee697544dcedc002d
SHA25606ae8679ead48ec35f952db5f87ab49633c6e942735b3df2af49c6010c5d580d
SHA51251548d181c74d8c67cf0c626696137dd22006d06bee14c49e25b32169132d5731bb960905a1d0b845ce1c16a5035cf15763513d01a2ff5486d8affbb4c5ba507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7e2f379f57d2bb8b3424640f9c9c088
SHA16afbd00f205c6e2f08ed46d648505d2324f06b1d
SHA2566d128c26346612ed8fb07d109c2ac82e695831ccf00be2cdaff20c9c4f4f8b70
SHA5125a6219c7101bd0a340906ce4671245d7d231aba258bba7c9d5414a7ae6742bdd2b8a64c051c930410ac545aacd08d68d8dbee81a9893524630fc806b9c7e9bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fcf43e0ff62e9dc04e470008d7ea965
SHA1da5a88134f5da93d50c66c135ac75a6ae476b62e
SHA256b863bb073422b2f303a1ee7b427302918f7f89113aad6375ee0f032a20f358be
SHA512a7601bb43ce5ef7e43dcc64a126d857cd7141bb6e7f350a0530e47a3bcabc526a9792522a9e0978abfaf05d9a20df0008a755ed153ce0d70035f089855f9cda8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a