Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
620e5ac154a32ea15f85cda461d23e85_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
620e5ac154a32ea15f85cda461d23e85_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
620e5ac154a32ea15f85cda461d23e85_JaffaCakes118.html
-
Size
51KB
-
MD5
620e5ac154a32ea15f85cda461d23e85
-
SHA1
caefd90ed6327fd57de117922d41c7aeb4be256e
-
SHA256
d7a6ea81302b3dc14be90743ba89ec19f4570239c4f36ce04294515e7e4fe1b3
-
SHA512
469a4e2c93fc214b55618ef11c7c4a91eba4927eaf702daf18e40df8c172fc490a03ea1aa1e11dfd0e0651f09f8dbb9a803b2266de983a49568c1b15421471d2
-
SSDEEP
384:NZFHApXITWDKzXMj2o8UR5UUIfn3sm0V7ZHUa8xWEuepCXAEMHnEwNfBgUg3CUMv:NZFYKDkFGMlkX/72oBOWlE8s6t0G
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000f046d4db8e4db4bef7765e94411ee7f2348ef38896534965fd4deba89aa0c80000000000e80000000020000200000007331db895e43261baf5b1219fbf2ab31090a8695775e080d57cfff52dea562fb900000002eb09a2339fe725b58496a6125d9f33a5e172f852b80fa0c65c710da8e868374fd5bb6aa6e2c54112947f6418dfbfb1834cd2b532966645743394a7705389d476e47e2b52968e0933ae62a341cb7ec93f996d6a932e5d2f99a433522600b3ddfbea832829395333c65ae197480de836a6fa3aa07ce7eb29fcd97c9319ee74a3faf32ef16c5e35ed4fec724fcbbf76135400000001432b6d583296e5d21e6cfb9562797ad9cdebc83c3e25e9800db6af19065f75787c3203593cda2c8c3eb6ef941448ab8890195a2e99c65e64d90f566f563eddc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d167e738abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003c88a504640dbcd5bad70b2aadcd33206bb1dbe5c409eed467e811ff9bd6035e000000000e80000000020000200000005f6a542e5cee8e1d0c9b9a4fe938128edbc661fc0365c2885194116398f04ead2000000037f94e3406b70cd074fdcb12ed65443934705758ae64af0b8abca8bdb7c7a3ba40000000a35771dc46c6504583f23304bc21ae1e1883b89d9e02d9d0f8392df64e65728425b5ac958495536e8fd20bba858cd248a0c38ea5ee60efe3fd1f962a3ed14315 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422428221" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12D7D7F1-172C-11EF-9E38-E60682B688C9} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2068 2160 iexplore.exe 28 PID 2160 wrote to memory of 2068 2160 iexplore.exe 28 PID 2160 wrote to memory of 2068 2160 iexplore.exe 28 PID 2160 wrote to memory of 2068 2160 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\620e5ac154a32ea15f85cda461d23e85_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5206afb20afa4a835ddd1788fd9574052
SHA1efad5bd68cf76a61cae9de79bdd233d4fb70d2d1
SHA256c74737a688a14fcd44a727bc20f2502a893d1b94c831cafd523a09f29b89994c
SHA512f91ce3fc0135ebe151c42568aed0ad0e977a4d89389b097550a031ebf7e7a7c0937133ab3dd5b9f7ecb8851c1fcacd50c3602e1b9021a343a4179129d1b4365e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508d8b0c611c2a0bf3206693e04e2dd1c
SHA14af54828b8a539077f933885474f8a65fd540344
SHA2563ce9e5264b9890fc90a749f5bab1aa449310675a06d6afccc149385c1cbc75da
SHA512c3a4d32b211b9af2941fb172b94566e1f64f795743626dac5662f71e6cbec146b431d8f0cdc28996aed5c224748c341df8dceb892731df201363874d2d24648a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57afad5e5c493eec4662e3660f4939fac
SHA15ca528472177f9ff5fc569b928bb11cca3997a93
SHA256dba6dc4750b23b2573ab3e9aaa097c2df709bc9f0ef07354fbbb5e1531fa6a82
SHA512dfd3776c2e75a97c6b3ce4cb51b3a02c857a6f8c2534a403beef8b921c50f1d9ab6e43ceef7a95f40a331a1a65840ca934d2b51af18d8cc246ba4f614a9a9658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513ab2c8ecdd334ea4919c5d9a5117e93
SHA1bbcf6ef80fe72fcc0ca1767a63929e3f29e34ddb
SHA256645381fa97dd5a69d25e5d6e64c8ff1c8085a49e26c6cfc9384881d089e88f3b
SHA5127147ede05a07c6a1b76e867d6fd39ec0078516c4f167e0dfa344b3a4fecad0fd9fded14fd900d3b6e13bf862d628ddd6629b8b0c23155ba76e7850a733580413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5234505427a4c224097a706ee89e36125
SHA19fe6f753b7ca7082c96624647fda22e14ea65e7e
SHA256e24fdae3aba2a41921feb4c4092b53db2ee764d8977e674a6237059bb6869e71
SHA512a923b35854a9dfb121bd2b3c0fbf64b0f4a0ed7a5c24b19377cb94ff6e6702b74d4eb485435e382a6a750c8ec2f1a5f59fbd88fbde61b3050d97638ddc7e5321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea691cfa05a1cec0f5742858274ebba
SHA15b461ad825d97b802622c9f5e0bda0d9dd61ff67
SHA256c663ed2cb161aef801167281c1d0f58726f75ad0526594128195b267a32da181
SHA5127f496e7cc3a12c03638456726726d7ed4da83144d098fff1613e08cc6689d05a60661ca248e78266730badf0c6f92a5cef2b6f2948d503a5721c4ffee2e56829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5341b5e78cdc2f0e5761452a2fe756eef
SHA1abf0a1585468c93a7090e36fdea1446b0cd3cd35
SHA256edcf9a9401fecd80c24859644b93c8acba88879cda1e5c8ca3c5371f22ee0a29
SHA512efbddf7ef01e5178f9632dbc723af5c230cb7f2d418956d4a1042037200129e7c512d435edfa5361ba4ea86d2d45449d39174d4ac20abdb7a5981434ac7cb20e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df3115e1f00f6865301c57e17a177a9
SHA1da103c7753693a898b737658dda5e47c21e53229
SHA256111553a16b90efbde3c1e6b600acd1567a292b3ee5ed15d74f3c7e8ecb27f9fb
SHA512903a873cd0fe74a1dabb177aec4582bc9a5a0a14b610d0bc407262ced5f355938b01eaeb1c98c308007303c2f8b6122e2667f92bb3d73e0def38284830bea00f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c48a2b44f62cf9d58bea7d1bec6b587c
SHA1091d63e172c320e83c17b9ccb9963dc73e6c4e5c
SHA256a28ffe6f433944eb51da81ad55ea0c815746d2868152ef3c506e96028d7cc11a
SHA512d28dbf4a06a4ba5b0ce59948c813f9db794fd50dcb0052684934297fc2886c6de5c8ab380740b56980f85b2ef676e4b160341e74119d8bdcc1533d02e14edc11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d19daab560b00fd58d7b54e2e48420d
SHA1eb81f4cb42d016311fb6ecc5be63676eef07c975
SHA2565cc9275cc04b111b1f9c659b033f542e6d078c0b2308c89b428b7e253da990a8
SHA51240243769945b5463499e4e84a06ba6d1b669726be2325ee795eb15c9ac6277afb26a85288cbc6721ba64eeac9a4e26b63b37827b48428ec03316b151c8d85b90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50053cb252eb260bcd14a1eb51e99262e
SHA12b0b34cd74c393e1f9413242e242babb816abf94
SHA2566a3c79ed6036d2a166ba92e9958dc1273d14eb92b1575a4e8182e7d8ab25c05a
SHA5125306290f49b8867a240c4022b3c0f5ede8f73e2dea85fd137bc79822d80dcaa8cc2c61ec8a8e388a597593d176fc1b91e3944292a8f521d6b74e9cb54921f81c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53313de5c51091b3de1d6382aa145c45d
SHA1f9ffaafe67779df1e8b09766c59f83244ccae17e
SHA256b148f2e16a6ef8708790c44ae4a11b2303f91f56016cb1bbe1d76db6744e3906
SHA51217c31ebe6d0a0b4eef428c838f9b86e4c54d8ad725eb3ef3f2a4b4d93157fa880f7c6c672dfb5525b1550ca9a4184fc4d9197f1e9f94f1b6f5523aa3bdba3c26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faf612cbe79ea057367a3dcb7da806f3
SHA1f2aee90ddad137d9e021e88f892141877655c8d0
SHA2561eae9f3fc68b5c91b9e67a8f20b0624277945eeba946d995d041d69867210633
SHA512f58d6975a002d57f0a33227088e5bb84599d906d40cf799b68f8641562c60393767ffa48e854324c554a4571436c1f9e23736ac5e4ba8038f4d5f7976c626d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58909bf9ec36fa831ed9f7bdc604ced54
SHA1c2f6e1a514032985ea9ac08b7f0bc9e5d6c72675
SHA256fb45af126dcc1f712b74b6f2033c306547b168bbd93498d5eb17ad9ec4e11272
SHA512a102dcb8980a6fdbf4c939d06da20f95147209a4572a1045d6280e1fffab014ad0b68430e6cccc8909978ca13e8df6e58dbe4ce82f39ac67aa8d60b1b4aa43ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566d782b170eec817ad0858feb86248c0
SHA1c2b1b0b2a141e5448ec923f5ee40d734e86c1d49
SHA2563ef296269583dc50919a29c8cb93827262f592810995a055efd6bd4b86cb5c12
SHA512494dd9c7dc93878cd124c7b17e4ebdc41d5ad1fe647ae5ab4ca50b8e7ba00c08d3f430ade735b147b3eff2bcd0a0a42480d9596d4c150bc626545c7aa40ec2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d559a99c5321fe2d4cc3d98a1565b44e
SHA17444beaea718655c3c271fee05e17f22efb82bb4
SHA25678e52a9b093a4c7052bf7a3a14d9c92dc3846ad1175990139256a234d266de6f
SHA5125b1fbc555dc7383cd81e2e8bd1f78b4ea89f6f1b075ded191aba3db41936a93121d36676478605536bc8b955b70a05c4769d64b45dedd80addfd7ee5161ecc73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebf21de1f800b2d9bb5b7881d3543c22
SHA1bc41877e94c58dddb3681a629210a29cd57261df
SHA2563be81eeef2f0a3e1a2a7d93c8aec931bef52fcf74c481d15ab893b8ab6dc10ca
SHA512bc270caabc4bb596957f7179ff3d0667c31d5f479e7c64672be3ae33520879bc02921b0fe579895b725c243bb2da18d8340149a68305a8a5e12c0ab80fee6272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb5208e3e76baf7b6d5f88dc414027f2
SHA16ee579542505e82e8df8eab5ae210bde459534ea
SHA2560ce31761f54c1e1a42734d065bd9cb61f514b4c19a9d79119982b1d839567206
SHA51241dfea96702d5fab42d7dd4f713bb7ac1e0c55591ceadb48b7212af1d0431daa6c07eade28c85f4c016998d4a96d433537a90df38c138241b5da27f4b19eb8b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a