Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
622f7e1781db2208c2a7fe8c6673289a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
622f7e1781db2208c2a7fe8c6673289a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
622f7e1781db2208c2a7fe8c6673289a_JaffaCakes118.html
-
Size
461KB
-
MD5
622f7e1781db2208c2a7fe8c6673289a
-
SHA1
66a3a873d64c91c10c187ac1b0e16ec3d9cead01
-
SHA256
c0ddf19f60120adaf89b45e56ce6cdbeb9a64781bc658584ce32493563e455e1
-
SHA512
b70fad151b91995ad9398eaa48a013ab22b6c76d20467ffc8f217931ccc53535c63fe686a3d6da6f3755273ac1c3e16290857b1df35622ab25fb5c655ae689d9
-
SSDEEP
6144:SOsMYod+X3oI+YwQysMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X3m5d+X3S5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C4755A1-1744-11EF-AB95-422D877631E1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bae04451abda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422438679" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000a42b480c52d6512d6a93b9b47213923f70863620375df2c5d0d02814849df24000000000e8000000002000020000000ee28c07fb8f4238630597809d5ef65f908f5cd5e8b9f7bb382f503c7d7ffbb4690000000b193a8ffd65df29273af505fd0c6239b35f63b0924a0e6a295f22573b53b2e12015c23ff7c7dde0bfeece7be7d201aebe6da8c114a76d01438deb52d9fc118d69c9edb1727feeadb95ffba190abbba18ff642d7227b7d8866ec5e50961d48d0fdf8baeb362a82827990b146a256cd52a416ef1ab05d7ef83f37314bc77eda9810485e02101351a89a98368c85934ce0f400000001a82202342cc5df3d2351934fa72d581cce07f5c6772fb3853244cefedca9cd485357cfd101e71acf7367abd4a095648494a18e4ced9c0b2820a0da0deaa47d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e4557fcb1d1377e303e883bfac4d351c567f74e826e34dc86d4c02cd1b72a028000000000e80000000020000200000002b1d77bf6bcb04dadeb833199f62012ac68f9d218527b08755dd24bbe055abee20000000e372991d3402fd5c3d0bbc8842a530942d29bb314dfbda15fb0563e813ecdcdf40000000c63a03972607c8240df31a76efafe31cf200980c90e9c3ed511bd2b1bd1ee1edc41a3701b28e451a3772ba22764359ca3fccf28c8c87d7bb056951e7cd7786dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2100 2248 iexplore.exe 28 PID 2248 wrote to memory of 2100 2248 iexplore.exe 28 PID 2248 wrote to memory of 2100 2248 iexplore.exe 28 PID 2248 wrote to memory of 2100 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\622f7e1781db2208c2a7fe8c6673289a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5845820eac4f32250bdf3ea9dd857c7dd
SHA1185f9391eec2063fd3b8f9d278db606ae5e11dc5
SHA2569240095eab4475dd2478b776814bcf768abb507304983756d0213f0f97ec701d
SHA512416f1dc40dee3bce90510519e1dda068f94fc9b8bfda6b806c57f637ce8a1e41d87e7b5812c79011e80370ad9d62763e3504f7a5b1222af11be530dcae8d3d28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5828103c8f6bcc0bc1e8568ba8d40cad6
SHA17276c33b0440ed319ddc493a0c19f92bf7a93cd8
SHA256738e413fcdc270f613306e75f8b9b918935af7abba857a14e0b915b1eab72366
SHA512f039acf47dc1838be5e9d5a28804dbc1902c6c6fac390add8004046f59230b67e1772be40cdae852208fd9b7fbd960796effefaba07ebb8c97092dff4c13ea93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52976dbde92eb3ecbe127732c803298b3
SHA1cd18128dde9248e93be3277e823ee2290ac374b4
SHA2569f485c670c2629d27feb17f06aa83ac256eb17f513411a79ace4758621402bfa
SHA512b0c3c2d7780a174cf86e36e9e5bdd2256e2dcda2224035f0c7cf9ed4e6105c81eb73f2099eeed73b1c1d093cf8ddb0ddb16323f3a117487c0e54d0fb2ab8d01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597909d5b7a3fee0c6347080b82d29341
SHA15928933da35ff99743ac46ecc92d2f2530813945
SHA256dd35f030d60db173c16c3219f355cbe00a55593ae45e3056c85a32da854af348
SHA5126dc52b939a28d33de31832100d74da5dc4a573a9aaf727ab44170e16c2c41fe9290f8d8b92ae4dd18873e9633732712ad8d8c037a20ad58965a38e339f74ffe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559618629523a3ff6d55d556e1c8639f4
SHA1949c91a85f8c01f5a121749711c192995e87fd98
SHA25694d7d6f548855b8af1a41181f8603ca5388a30336f168cfec1eb0d3688764267
SHA512da37f0ff63ff2c5a687c1b14417973c5f194a96c881ea228158164de94a84a351b5eb8a07066c38fdf8ff5fd982800eeedf57f21a8778c0d3905742220de7177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519db36ea32cc72f0fa4faa5aa4144e6c
SHA17fd67a35607a1102dd20521eb485e0d7ace2fdd0
SHA25634fb778ff23ff1d3cea043eca4299d8fcf30c8a1c06ef839dafd3ac150b41999
SHA512240d767891b0a313b9f12fc5b12c62ef76a5bc2d44e6a90d10f07a199c04b4ab42d13bb8a253b5e1ffe87c93cbd1d3e4e93c8c3cc6a5704eda6c1a48f6183263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbf7e6f194083c016e276f1a61509cca
SHA1dfbcd5879206c57953832c9b1cc446e9039e55a8
SHA256fc83eba504c2b818e2857187165c2bbe18633d00c3e5a35b1b9c82a137242adc
SHA5129d87852b65891696fed5750b7ab96ff197a2667c4fb3dbce21bdb9a109688fe97b99e8306e14fec894b321a07a1179711e6947726165d6789291200bfcc593b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abd8f7d7947d5822fdd6a6e58a65069b
SHA1bbbb1f7d2c9d4395b92c8f86d27abf9e8834616a
SHA256a09d016f3f5a634f1f97a1e778aeca4a7010078adfb466eb9233eca8713ebb89
SHA5125994f1ef95192145f16740555ee23477d35104984266d279d8b0f9aa61511e30a0dad0a93890f1be77ea08126826ccc89a1db983b3179d2c4f587b0c035dbb5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560937cefe3c6181992c4072f84eb272b
SHA15818c71a23a45dcf2fe0e14a34df0bba5e9d024c
SHA2569997605ab30e2f5be4724fec68fab8c1ec850addfebf1910df64c1a3c9c6d9e2
SHA512b6bc34408805869c38c5cbdae3b8adc8defe223130bf62076789d4c07dd07bc676e04bf26a39a12a148e05665229e54a2535e454e89924c9757778df5fae475e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d05b7139aa7afc9b0c8c179e4940e2c2
SHA1c3e94dbfa3b388f291a3828b3e5392db9408338e
SHA2568f367f9b50b0fa211d6ae9a85f3ba19738cfabd961db851307adeb46cf8dac34
SHA512006a875f44fa70b837a1b0288e1356ef9e868f860cf3be5a65935710cfc71ef51bedd2396db596815eec6ff20a4b506cd01283ea7dc546301df53aad9a2bb0f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab3f0b3aea1a34cbcf31410d18398d0
SHA101297077935fa6fde36eeb0c565a5f7d1887216e
SHA256b435ac92a2b0e1fea1e53e0065b78b448ea0ff67281035105cd6997ff3daf28c
SHA51273f104f332f7823e26e21ebd0badc684d3e159e63a68aebc4699d375649dca1761cd7bcebb841955c5b81e4b8133188f6bef0060c596a2535d85d5077897cfde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c539f1fd6dba6af14d224002087490d
SHA1e2069b97c8593ae61bf79ee45a2db0e59247f4db
SHA256e63c378213ca57fe20945bc26117588939125ce1518495c04558f7ec490c547b
SHA5126141beea49b1b46fe441681e133c461cf09cd26a136595160824d17e95f0dcd03d37225385e0e97923b3f37b75a6d8b07a26d35a605ccb4d872de6c8fe4665e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a636c6b22c6aca3fbd77417923bc5b1a
SHA1584eb812ad0dbcb53df6fdc70b7576345b0efa26
SHA2566a06054688f8f17aabff4c088166eccdbc5c0118c05663526d3a5e413056a9da
SHA5126a9e66e6dfe8f210e02ea295a485421d566a2feda5714d38417e4b9be5976d0fa6e4efe55ed7f9ff8fc696addc04c05f23484670ccc930fc702548c73e458bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7a3f8e562f9f19ac8c8be03c3ba4f07
SHA1efac6d142180a224e421bf1959456f7af43c3e52
SHA256d00bda1cdd5a967e807c712097e2999451a785bf3be7e13ac1582903dbd87254
SHA5123690b37eb10c82ddb86c0471257acc3ecd2c1e7d6d59fcf14a74454674ab22085c271d9b95c805e6d11288cfc1c61680b3d7780cc03d7507973006f1e1c3bc70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a45572aac8943e5a45c5b3023bda2d0
SHA1addbee1fa599572af23fa03edfc2e1bda078b795
SHA2567cb0a5ba564497d8827116c2816cb056ba196d1888110cdfcc08335a2daca744
SHA512db3a9af01c97ae5659e0d56daba52c7efbc9137f91660135712c5eaa42555395b1ff110c2a490d2209bc119d5611d0ce9636e5eba35be32a0bcce05f7b378199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f1abce1b7be4eb40f7599d8e0e5be3e
SHA16c921c3021dcaefd8c3bf7d1e6f0128deb37438f
SHA256606d0a9689faa835f3ca4adb7749915642ed2c6af63315e6521aa8d746265a23
SHA512c62a00dd4e4796c4bf27c7a4b3350b92633874cbf0cd91ca8743b9875d8e76579939354183953429905d3af3a05829e00157d7c7992c046816a028d901fc8b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2eee26eaa1962500f9ddcafe8f2e239
SHA1f18ce239ea484712653d299f9fa3b47851fdbbbb
SHA25647bee3d396740c0b39db088c1fea8d1e8d1104918b00e271855e205c508d3704
SHA51234f4c2d7489b68867f9d964766d753f10ac370dfbea08550315be0c18ba46b7c9a06721ee4a47030d8b184ba578262e8140550adcf130502572261d8c4eb2e05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ec7333100dc4bc2fb89975718a85f3b
SHA18da1a3bb0f4039f2ecf07c2b8a55b2b3b02c2507
SHA256bcd806c7ede32c1a740652dd27aeebd8c89375715fcf775fb084aa58b9a2ad2d
SHA512bba0909e69c65d24545dfdf1cd9de27bf68093e13abd3ccc6df219fe76ba1653b52b6b1e9264e7ca0fc25db058c4345a7cf3c0e687ac47e106190b8c6cbe1223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50afc7a41ede9ddafa25a685731c2dcf3
SHA12014a02d91a5b4c5c5885c1f9dde1717f1c1f2ad
SHA25662f3af907d17222bd0f5c892141750d03860cff1dd5ddf48476e5c9690a3c977
SHA5121a0682b7424714a1c3d7585742c72a311cd609a1fc5a8fc7471d8d654747aec8ebefb5722cd3836ca948dbe77e1f2184db5caffe5075107ea87d544a660b5827
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a