Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
5e5c0afdb470194ca0aa1c9c97cee03a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e5c0afdb470194ca0aa1c9c97cee03a_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
5e5c0afdb470194ca0aa1c9c97cee03a_JaffaCakes118.html
-
Size
4KB
-
MD5
5e5c0afdb470194ca0aa1c9c97cee03a
-
SHA1
6c8141ddfc33909fa3ed0a80924435829d9ec9cb
-
SHA256
9e4cafecea9823c7eb1a77acb6a1c7b0c788fc00f6e3b7d5c03d70cfb4f98ae7
-
SHA512
f89f36169e2cd65bae8d95e6f0fd9ffb220910f99d46e1725e5e658aa31bf4cf5d1a16ec062f88e7a0462447b0c0e6993846d7fe5022fe3ba6d1a65bcde71eac
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oTbd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ae67c273fbd7680adf99eff9b5816408ce323e3a2ff1c03cd1f24ece61cbd1b4000000000e80000000020000200000002c21e77de7db766593557df4aa233beda198a417d4fa01fca2c709685cacdc88900000001a67faa936fa3b69129e4b6539ca8cb1f59eecdb2d5e354cbfafb4a35f7297142ad87126970fec8dba30b2619b014a67c49554553a32af7f7c3551e9d435bde7a651bf34e7ce00b44ea7dde2b613c7ba63f157434e18e027469efd8e2e6b1b0f9a1def421833ee1b1501aa8a54b16f908889211cbc26dc24ced06aaec9531d38e1819d17872362af52532a9578a468d2400000005d9bb6dfaf8b87d728979c65ffaa1a4dcd5543ac3bc8644fc2bbf86d156fab96f6717379270bbb2390fc29429b3501c45b01d6d76540a04f1ceff6ffd433cbb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d4605998aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422359263" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c2ee52d3390b3b2bcefe84e1dd377e567034ec85d6288f0e933e3aa337ea480b000000000e8000000002000020000000d596b823a531b48fd81dabec1a7838faebfedacd05c37ec30848d3702cf81d3a20000000a48ae037a1bd84d77a68aefbaf05933d00bdb1fd8c137611351052d5f1a0049440000000fb86b37051a56568897d578479c67a816ef81152840356222bdd00638e82cc95aa87fe4bbc16f2010ab291a4e92045531bd590528cbda78efb4a089894d1ec36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{846C6C11-168B-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2892 2804 iexplore.exe 28 PID 2804 wrote to memory of 2892 2804 iexplore.exe 28 PID 2804 wrote to memory of 2892 2804 iexplore.exe 28 PID 2804 wrote to memory of 2892 2804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e5c0afdb470194ca0aa1c9c97cee03a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c4a75ea030ebbe00aea3066c47654d2
SHA15d393a32f3c3439fdf68c6580158a5e46b4d1422
SHA256a09b786ebd770b6594673e8910aa6e001705a758fc165fae66ae08cc40e92bf0
SHA512324fd1f3f3990fd0c5d056c4bd57776e86d2fa33a9bea02c02115eb7b3ba97c4a812d2350e48bd96ca34a2a7ad954ccf1b49973a944754c63f50ee51b8a6abf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56724bdfa325d106b3f5f771d0de72947
SHA1e9c1c896a9c3e6fd6815cab7205f12f899ff9e57
SHA256a304a9acda06e10751b20bae5485b6ea56116e413e9f768c2917b31a76dcf9e3
SHA512a24991a1d73cc32e17945714b3a002d1ec9d8431f8939f3ac33919900e89e174475494320c5a9263b00f0c6793df5baa87f7294d66f48b77f62bf52666543aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ddf0683daff9e678028bec64ac9fcde
SHA16608e280e2fb135d3051ef3da5eb3c7fe046258d
SHA25662b7b2aca654905e0dd7791b0530640d65e42a263466fb66ffa695c1ad5ee63c
SHA5129cde6201a1fdf3d2648c1081f4a2a1ca6ba4c24b3b2f487a33e6228712b1567c089c949ddebca9f44475fd04e8e577ed7b28cbfe3521850c037610814d623f13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584f17fd894fc0221d6d65307535cd91f
SHA1b049c50f928061cfc2d4e3cbc6426139903f385c
SHA25603adbfab38a93be02ce4d085fa3b0c8eecf942a45698302039fdba6316754fd4
SHA512c914a2fe8ee3efed3e429e072b06e17377f8a7f9b0b2e3ac2f206e390cb79ff98d6129ea8233a92243500d7c2c2297ee8ef4c18cc51d7c2cce4c0475b1c027cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b3a4931a8652c868dec7e2b13de4453
SHA1dd0e05b45c3974677339c079186f918bdf4456c6
SHA2565b3f4b35c0566848c26b797d3f6afdb97b622d031b5a7e7380ece64f8d9295c8
SHA5125309000112414388dfbf503167c7833a5fdc9520e3ea4e1b1f4c31f16a365ebcd93f6e0d15b0bae73663b39ee40ed2630e1551d7ac26cb4761632458d4491830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5117e0dfcccb6c36008e85e503c0b15de
SHA184849e1fd8b08c10133e5bbc4b1f45b8c17c4436
SHA25696ca5da415cf61a8cc6a69a563f72f33097806c03960cc01a705c95013068053
SHA512fc03627223d68b54fe26ff0bdddf173b824bd1b429b0df10006c3ea2f678c158a31ff63fb610fc883e225ca7af7cb6a713edc7bad029d529963393d28a2c9199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d53f89b54892e86afefbec2beb73a7f
SHA11b446f8e328831b5b69cdb8d881ab10cacfd5bcd
SHA256ae6c82ef9673fd57f77a3a8dabe7d413c2e9ed5597a440d4d6890d98fe7a7fb5
SHA512bd594fdde7d931a97797c1d370d5c502a4e794be91cb9b092f16c8fbdd9314435d183fc259fe454976b9ff19f1313285362859a52d903f9504c7705d60e99232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2ede597370a8f4007a84db95b09760c
SHA13eef363409468a1be6bc2e637df42838fd28ca23
SHA25606a6dbb3abc0e3c03f3fdf734825e42954651f78bdf27472f8bc09fa16880d4c
SHA51238c44d0111eccccf8462b1172c0efaec24fd2a53c9363f5fe0b916bc67f223e58363db177dd09c383a9ed5b8036bf700ed4a878caa1b18b9591de36ef47600bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5544fe00266edb09c8479108b017e96fb
SHA10791b48a5d5ef196cb8ad4dae2981e63c04eebed
SHA25620be86cb625ff78aa0c2ae4dd00168c8fde20e580e951073d7210edba414484c
SHA5121b04f33410792ebffe17d49ff839a14a7a9e8f625bae58d09c348d19ad32c64df7e02992e878ebe84c48a71c5822a1bc4db9dd2c1e9930884102646ea9192384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581c6eabed39d1757293eb6967019aa35
SHA1e378561ea947604f6a5eab6a5cffc2386ae64c48
SHA2562cb594b595530c6fe8eb727e3aea1c17e2bfab3af98640a3746e1dd0c29bb00f
SHA512b2cb9b07fb197016976dd398f90119970ac9b56f8ab643b3484ea33fbc633ca519491bde54870db5d2d7a105f6281c6e134c1cd7506b10408057c8fb72c8ef46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8dbfa2899f11699de5a3e3bf05c99e1
SHA12bbbad987a9f996a0cafc1e1abf7aa0ac7002424
SHA2562e46a93c3606e649989387d210db4e47ee19a6a2c669bdbe2c460269599d6aab
SHA5123db3f915830d90fb1de97d057380ee36cb8e20bad6a7c165f0e63f01d1132f9bbee2110f2ca1b30ac04a64ee8bd4be88e0d20786560ab7303cda04f79acc147d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5379a42ba6672a30bd26605a033e95894
SHA1f9ae3453f802e4ec5c71197b3299d433c05e24d3
SHA2568bf2cf21b7c0c3d409e45494f3e301ceeff117222fc4653bb8e4a44eddb859ce
SHA5121c45c4405707d4990ba22f3cd2c3908fbb1c2e935c01a4ba5d8e517c1c40f03a680df42797e18dfea489e573bf0c4f82b7c3d689cd4241bde3b96c49bf67bc91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5d838c5b35da26fb34cfbaa68a42df4
SHA19f4bc2cf2240a6102a0252ab4e57b38310048ab3
SHA2563290fdc5db360ccda839298acce02ac1d340883de717dee5f862db317719671a
SHA5127c97178c7d464fbe371667887576af281f1436cd6129b77f70528f2f3c300ca061f96fc22795ad7bd1b5996728e38547704e14aab0dc7e860bffdb38158e807a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0166d04d98df63b214d1c8872b7ef2a
SHA18f7d2941a21f1daeedb7cd558eb2d297cb12b6e4
SHA25691ff1243b2a2abfee45948f597d4794d6f4b6abeb02da32856b3c98fb9d500f1
SHA512516bafee8699f6e73c96771900d872fb7553d6a51eb89962cf6cace21cd8e50fad984998a2b914596720c5436656cd8c2abc0936cd6dfc062c55415046a0f874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570edfe1e581da2918b8ae2378d22c41a
SHA15c49b87477a8c72a396fea527df2f49c22d4d7e0
SHA2564bf94456be6c3d7ba922cc59fdb96c04f5a9ce4f3635f88136fd111af8d3f708
SHA5124a4d2f7c7b7472d85c2ffb52f222046f58aee4cba9cc83672fa1497c34d140005d0a093a1a1ab2aaeb276d01e182c7328c8e65b73035c975c21234a38f3f6711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f384afc3ac165a88f03d63a258c969f
SHA10d485fd793b208f661589a0e42713fad11e011ec
SHA25674698e2e1cabda02abc2ddb1fecb095710a3849f0743f2eb4c0291457bb4ffbb
SHA512e6b5ab24fcf64ef2063a25c71000f7697e47cc22ea409d37bf8681bb46bbc659b49f12d414b6dbde1000c54707cbfb6ce3da35d0407fcbf26f51d7a20dde1451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d01c61d73c453a3d245dc9d1f203173a
SHA1df6c8e0f70a47f37eb208b053d483be653822f5c
SHA256896605c243eaeda5b302d0d07f84620bb9044aa9db46a3d8d60384c65c2f7f09
SHA512ee86870ac18a17b1df822c28a6a6a5dcf14045b66a3d6b7299bf74580f0f556300892510b069a568218b46548f4702e0276d65367a71c0ba184a79f3c21b432f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f44c0827c73166a4d223cedfb4e151e
SHA16264591be6cc7166599365a0c8d1f852b4f1b2cd
SHA256b7567fdf0bc15cc9c6d6bf5f6e330fa3b3debdcfcdb7f0477230fa4f5cf0918d
SHA5127c4f2ff9e326a92676ea778ee8c97b2819ca9cc6f7fb7a5985034730f47af85c3da436a58c70b9c30cbf9e490765e60e00492284b5c3fd2a8359eb1a7be78e1a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a