Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
5f004de293401016137050c709a68277_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f004de293401016137050c709a68277_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5f004de293401016137050c709a68277_JaffaCakes118.html
-
Size
7KB
-
MD5
5f004de293401016137050c709a68277
-
SHA1
caf9f432155fc14833536c63afe3fe6a80cf47a4
-
SHA256
ad536a39057d6b0a887947f318c32341f0ac905f1db7fabcca9fc4080200ebf7
-
SHA512
5c4f5517a872bb9214d3204d60d31cce8d7824836e811bd4587e3278c929d39c76f64fc20a46ca1aa91eb3967bac08034dd3ea0572562d2a7f4fb1db8886aea3
-
SSDEEP
192:QE8BFw/0AVQ+LnpbFdfbJKYpU4bMKGsALO8+qLAyKlf4bkOhWckEn:QE8BFw/lu+LnpbFdftKYpUxKULOTqLAg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f1ced2aeaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ac19246e51360ea2218d1b8aaddf5caf0857634b1ec49356c60c19742f87a4ee000000000e80000000020000200000003be137c21357ea5b70e8da58472c1bc966bf2eaec005ba05f2c2375a1574bc53900000008a23e5840a7abc1812365b33c18d2c083f9b48ded743fcf19601c14e4d37ae0f06bbc1fddeebf92acf5c63e99f141daf522134c33d619d826897b8ad41955ed7be8fe29b7e9d2841a0d117162a972ad6b5d595a85e1f601d1d8f85f1aed0268804ab6264634bce66cf631b03d25d1d191f1b8fd35e0c09064d9fe55d5d73a6c2bddf15ea6cd0d27232e1ae1f1bbb7f1e40000000dca5686499afaa6f0b752b6158f27ed8f9c77364ffd7110faf9b6cadc4d8b96920599933049f5019b19d278614e102ba045afd5b93fc0792a5b324628a88889c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC3F2651-16A1-11EF-B671-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009712b36cfeba90a2abd32032f5d844375534a1ce02180386fc3e14a13f3c69a6000000000e80000000020000200000004eabc1afa7bb3a1f5678cffa96ff777e2e0046381d1881a725c07e0a53dc68a5200000005d9dd2ec0497cf638d8d498ebfd2f8ebe36087ba98647d304dc94efe3e7de12840000000cecc8d6400e90c639d89cbd9317729a09b21acb31023d0fb3a478cc135dfb9a9b4b9bcdf2b9ed1a73aa35cc189f4915d3f9c48925ae36795c0851c499b0c22c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422368887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2612 iexplore.exe 2612 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2484 2612 iexplore.exe 28 PID 2612 wrote to memory of 2484 2612 iexplore.exe 28 PID 2612 wrote to memory of 2484 2612 iexplore.exe 28 PID 2612 wrote to memory of 2484 2612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f004de293401016137050c709a68277_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55255e3ad4c33f3e751ad94eaf45433bc
SHA14cfe801cd68f3e9ea68a28df6fc05dd5bd59591c
SHA256ab931bf7163a3806b0ce9099f9bbfda1af65c301d2e6fadf782b98dc73f34bfb
SHA512a9d022c1b8cd797c2c48504b2cf3d81d2de04c6603d53323df74f633313c2d3483709204e94020852bba2bad80b5b633deaa5534caed61423db9dff79ee7c67d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f37fa98a559e5653d9a54c0a6374b30
SHA1eac79644d1a078f8bcb1e444641d83830bf0f562
SHA25659ce027930eb58d46507a71d23a13f88b487b62a8123db0e9c8f956b3bb34a03
SHA512fa5521b845f8f70ec241c25d9db4ba753930f054c394bbf9b5cf5b7d062d80f4a8da6750a916f415f91fad2e9ffbc63f159fb1a06fe9d1f49f419163a7eb3e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5342e0089deddff07d5da2924e9e2d202
SHA1f85c171901672fa8b82a10d3c16e568da5f4fdea
SHA256fc32396cb4010bf4d2217df4739c1a1863b0555af351e0ca1ba8959550caceb9
SHA51245115da8adeb1daadbd3270b4a2281818c3c142861259ed5b4970e36abe5b13814c29d30f540b31854511ecd4f5b2040c607ec3c0f46bd32da041d0488a11aa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3b4d9fbc752f5a74f7818580785c3f
SHA171db5fb72ccc010d4693fcadc1f6dff520edb673
SHA2563c7c0d9b1e7c9a985ec597aaa22bc45f9dc092c2f82aa0e33c9cc2edcfd5a5fa
SHA512dd035836992f399db583cc9e3e8ecf1d082e770f9eb8c65ae2222afe76575668d563a2f887cc3e037e0a2b2aaa2ec87163a5797835f254cd60d9ae4c578e54c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5a6b1d7d1ed843dc0dacaa0ee7d4c4d
SHA1648742222db5fa2d5313a4707d60d28b7b274a01
SHA25648384a342c5123c3de3ea7a4b445b1b9f136ad3988ca377e487ab38ab6d9940e
SHA512f487453e6117d8df7acd5e733908d8f59530881ec6816a976396cbd230eda9f77afb18f5a62e37a4ca13bf332075a962069e894fb72f7fd119d212775640ecbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5782b32dcaf741a30e65542da9b082fe7
SHA1ec08b053a55c70e5436b2bbde16c72b9c10b36d8
SHA256cbbf75d8febbaa81fd2869784a21be78a0c2039be3da9913830a1d3624f494a0
SHA512f9b73257807b4cfb6d5638587825deeb275078779eeca2abeb9e24efefc50d5d7a86655fde1ed45869a0b19eed489c94c8d39d3dd6b70c16ffd37acbbda8967b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aa7fbd9f8fb37de155d277ae9dfe362
SHA1374abeb3d630850c2ebbf07f571859b0661ea0fc
SHA256cfc142a22e670bf84ab058ac0223a02c34cf36af9324725bae1f06b4359924d6
SHA51226863c006a6bc519cf7d8f724194402c2767dbc7ea37eb762b9102e4ad2a0d457141e7d0844429f0cf67108da05cb139184b09635e11ffe04feddec26c437abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f8f554aea7081142b7f5a15832ac5c4
SHA15742bf93115370bff20570f4c55f7b76a0c9b0ef
SHA2564460b72f40b6559a5583de55c5b37feee5f729ab2e7ba298be3c83c045e355be
SHA5127f45392ddbca009e805eb8a6d3decf7c7bb12a3f79f1cfd102ded82efc012feed7a1b7c8279c9fecb10338ba1df65267752ea31c5d6cb4706ebf8af6925b6aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5495f836d186fe5749624e523d2b1e94e
SHA1f16c6183077b2df2639601cdf836fc9564ee61e5
SHA256bb444001e203f055ec0b0d986c0cd0599dedf71a4192ea27fa8f0cacd7220ddf
SHA512e61e3e4a9bfacadedf4cfd451a4f389e2e995396c1f2c23a7a0a42815df22f8344b96b799414e76205e49401b0282a1fe4eb8945dbc1a61ddb2bc7ab38581564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5420cde0dfc50a798b1ece7538d2ca40e
SHA1a637608785c3a8f2d893da84e7f814c97fc0ab92
SHA2562a199b441be0c95a66cf5a823e0549820bcdfc2e12acdc7123be51c44425c7d8
SHA5122b9c9209c6c5ed2a20238571985a9eaa6ae759abe12185c9f9f1b9db2043fa29ad718c74177e6560d6cbab565d4a19bfb6530dfbb6bb038b0d1ef87b89d0cac4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5512927be98c4cf61d787d4b9d5ac7efe
SHA1655c2d939349c8ecc7f4df17edba86425ca8d1b5
SHA256a5b3ad995a1d39e9fb6f3b63ae5c97743e1e11967adee6da78cdaa845bb4f6b1
SHA51232bfaed182f41671101dc99ac0e7845808aa2c9cc6302cb4a765200949fc9a9cd8b7a588efa2b6406149321b0ae268825a51f354f7d3e24e35d1aa1e6d76a916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a416b24060e5b2d160faf20d10275c2
SHA1a3c581bc68192e8e9526ac82dda75a7331d31224
SHA25656c6da77f084e3f002c09c7176512890c70fd344445dd3d2452b9e87b530c27a
SHA5128e4db03d5ca12415f2e2f8f44fb958d7f8caaddcff68df61939d8eeee7410ab477c2f75af8aed8a4220a850c57ed0898a390a9bf5f3b5915b4178b8cd8908b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1383c5fe5207c738836ea71767e5ed8
SHA1980c5a00dbfa1d7896d6fe970909b3d2af597dea
SHA256e8d5b18453c4ee3ec8f4f92a426ca80b837f29533212d4984e1a8905937b6e36
SHA5121e1cffd2c1e531cf969c04f0c5063ee5ae708add92619c8a086d294df7b5afd8c67e09b920986751d6139814acd42ca8fc80f55d24646f0341cbbab65318c577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b711b45aecbfb8d43be03a13877a4c0
SHA170bb3bd99fd3452facef292358698d18f0f61a3a
SHA2561c5f5e07d300b2baa255609e84d81d0bfb3dd0b258a8ca4d2d27be5d4cc45957
SHA51251f7bb244a3c86083661370b5b65b88b4beb94f92ee543762b526873fbbb73e07c978776150628baacb7d8dc71aaa7de0c28f07b35d0e670ab70ee286db122ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592e0ee8a1f259e4011e476186dc1bd41
SHA18d78a8c68e56cab5d910e545e89e788128cbee32
SHA2563c3fac7e129405bcc588e5ccde32e3e149b95f8c23b895c48df8417cbcaddec8
SHA5128ba7dfa9b23110a463e6cc447c253dfd36a6a6f67adee92d2d6dbf933bb86b79f3b83601a0f4f4d50cd5ff42dec018cb59d41edfe9de9852c6aff20d328f7969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8a29f64b81d278f16ebb7bb0b3c0d81
SHA1b8282ab15b6339dba947789d34d3d8f61917311e
SHA2565c80ceb61b6a74bbd5d46065806769a8c234090d66ff5d7e9e9e71edaf7b85f5
SHA512dd398b4ef9ceba2a9aa9b0c4520c22a328c03288d6990cf951469c777f26d70b16000e53b0e69c955466ad041edbc1254b588d2ad7e261e139971ac71c67d9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05c42eafb8142938c186aa98d9f4ef6
SHA1563defe729da059a10acb11dcb6a076b65dc1211
SHA2560e14f797431057d832650d9eb3f00c1e8609c21f9536e2dee89f733b4cfbf981
SHA512e30d3a7c985983ca68bf5178355b1f353f721246c0ebc923bfd3526f78b8306fb933a7202bf9d148d2dc95d5c9f521e9c193f1b0491d762d9362a0f8281c9451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de26a952e66ee83d9e332870df4f86ed
SHA122cbaa04334db9ffc339d2484be6c253d33b4f13
SHA25670172412e17cfceeffbc06591fbfc52060557b2cfda0e86ea6f2b7aa75e03289
SHA512bf7924598242610eda5f6cdfb7423936826fb1f80c431ff459c9c4347fb0e86b95e9f644a0798514d25ae0a05b1710a798fc16965ca5de64060682f3a3957d65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a