Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
6448fd295a663c47f71aa8d02fb8ca56_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6448fd295a663c47f71aa8d02fb8ca56_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6448fd295a663c47f71aa8d02fb8ca56_JaffaCakes118.html
-
Size
68KB
-
MD5
6448fd295a663c47f71aa8d02fb8ca56
-
SHA1
c12429f5703a7f6fdb1d58660b8687149cd56f01
-
SHA256
2c445ade9fa3900003a679f55d0890b57d6d9a95ea33c81d0021fea40403745c
-
SHA512
6386906663a153fcb14e743e48a347c7de71e7728acc26d73ab5c20d8c9405d992378dad3ebcdb8c1d7099276705e4ec8798621b9fad361f5c02dbf130c11448
-
SSDEEP
768:JiNxgcMiR3sI2PDDnX0g6Cxx6eyAmimPloTyv1wCZkofyMdtbBnfBgN8/lboi2hX:JNR/y5TPiTcNeD0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4847551-179E-11EF-9387-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d62289ababda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000109b60354346924395a85efd345e6d04000000000200000000001066000000010000200000007792473b8092870f04f166618bebe38bba4bc28b31f0748f8d42ed9486c6b03a000000000e80000000020000200000009675f79c24231b84e38905bbe4ed9d71cb14cc259a2b0640ffd32a311df0edaf20000000609d80a7ca8c057db2a0607e680f13bdadfef2763c8e7a461cdbbb277fbf24274000000013d3a06e46f50995db9a21b01b58769009e1ec43c41b1b97c5c3d20fc9c857d2e8a8a5edd7cea2a311ca7c2ad2ce1581810e7929f42f5c52520b6472e86bc822 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422477460" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000109b60354346924395a85efd345e6d0400000000020000000000106600000001000020000000d5e289f92cc1cea5510297889a3f063eb6df94dbd5f11903f8165e6d161f7489000000000e8000000002000020000000edecbcff28b90c82b31af213a34834defe118a092d8451f7b74e00364e58101a90000000fb9bdf3cd294c2b2b8d8090c26582c299843c93d63048051d8677789968c12e63ac0f42416720ba7ae43a2f3834d135878665c4de7546c6b6b8d76ed0860e269886e8d9e6c1df2492cda78dcd247978bf3d3be886985be976a75f3443cfbd860476b2ffee4207e68e7938a5e5110b007927bab9bfb3e361fede8d3a2842b4f513863cc88a9315f44b158ffab4e6532624000000067367a2a49468a5f127c904c50e0570f2ce2fd15ae2966e7e9bdc79775d9cfafc44fdb6a75ac3f41c08d372c57c58ab696c9caf3e01f6f1f6c1bacce82c88788 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2556 2036 iexplore.exe 28 PID 2036 wrote to memory of 2556 2036 iexplore.exe 28 PID 2036 wrote to memory of 2556 2036 iexplore.exe 28 PID 2036 wrote to memory of 2556 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6448fd295a663c47f71aa8d02fb8ca56_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbc270a124211940337c361e70f22d64
SHA13b2356fd3dfaf24aa91ad276c1446da7fb3fb992
SHA256b9f1d81c412498173d348d5a91cff483f5aae511661c0898add7923865ea0532
SHA5125d4d69b5264d7544719c43d2a0ea3e130224ddd0eb81d829f94916d320d6ea8dd66a52ac4d5eb2e39d4a6c5d776cf7ec07d9aa9658124480982356b211b5e56a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de2064fcd0d11d9ac72956d118fa48e0
SHA1b52f69904e6735fc07a2d624013dbad7ab3064cd
SHA256bef0ca37766e976fc2f4ea350ea4e5cc574d39eee6d3627088a5f7a4d399b7d4
SHA51226f935ba69982f0f213a3b79e0344cbec293c738dcc8d0612c88858ecc57bc8c1970982f01faef1ae38b8b298a4eea4b3dda7300b892a523044933105c2677ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb70fc6c9b4c8c1f679b4e2811d34da3
SHA1d3f966f37e70ae42e2b14bd26a93d64f156a514c
SHA256d305530ffcea75eb768864a8be9204d34e64994c7d0f55a841e4138e5e4be811
SHA5120766db0b1494bec28d8e640308c3fc5487d0049cf4422fddbf0cf01e5f48982433fd4a7514018eca118983a1a3a125b90f67c9f09ff4d93f9e6b7f40ca5f324b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515dd799c4012d15bbc3507b5b9a0dfeb
SHA16ede3ed98d264eb23fad9634ef74aee115081602
SHA2563092c99d4b60dc74a44e0d9795432eb6c3e925cfe7f3435da82d1ac722bfbaa1
SHA512d7dc5acbcc48b51182ba451887598f6b4998a413dedb50b426f8b92aa818b03b11b9f23df6e48f5ada96988a0220fa0daea10fd8a2bf9c58532e17db0b69bdd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59870d44af5741b01f8653027585e64de
SHA1f51fd2499bcdbed0b32c2eb149fee054a4b9cd32
SHA2567a27f5895d5c5ce8a323340aa0ee9492550d1dd46c7d334387c795b441f2ce21
SHA512ba63ea9db37003189e47211b6aef6cca57599b032b74015642ffe89f782b1295d271f12168797c325bb62c2701afca634e436e51f76626199626c2f2a372857a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2871447ae5133f178c273ca704a21ba
SHA1c423f44964a033f5ee1879a892ecc18dca4683c8
SHA256131e71e4052da20665e7544c57c9ffab4c67e4faa62e7a5000665fc28eb64b4b
SHA512fc3658c19e50843d9b359363d8c4c43d7c7007cd44f674ea0a30bef971e3b6fbb02c945f3519ab9cfacb22f0cd602206e8343a5f58dfa9a6c2f0920091d4df5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d429ea702d748ed6a8704766209672
SHA11863436ec491e720b821428b2a89faee60668015
SHA256217d9ceb271d6627c5981feac9251de2abd1752ffd41ae0f363432670facf4c0
SHA512b73cc3b7352fcfcec61e61ac56861057b040b395a94061d1873bf898aaae0607beb4590793216f0e2c36453867a0c6938d1e529b61ded6b47a0eae67ae469d50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de554463d0481197f7c478767ca6f304
SHA1d63eb77411b7e1d3d1621aad9ec35b89a8cbff74
SHA2567a638a16eca597dde045b5a80dc23197c555ffce8d968bd823bf1711b91766da
SHA512fc3f3e6cc0432ef589a3ec2cc083050148359c0cdf1e6bacbd5bd68f167f315a108697064909f676bfd27629baaabdbc89c069fad7ad3585ba0a368256fb6178
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d3a9a11a8cde471dc69b96eb74a82c
SHA1b672956ed167c2bee185d54bee6b32e09b34a26d
SHA2565e7e412898ab12a57d9ebb1f0fa521d8cc4ed050a0e0d5b1109877de244b8669
SHA5128b07748437a0af99470f4e252bfe901ed0fc052d704cc7994620aebd3370d3031dc36fb5b682237e9980d1fbf9da0a5ddd3d7b7e0bb3c00998eb277f5272861f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d6ffeb8d9ec4f4d4c641afe61991f3e
SHA11a51d378ef3e6d4243dc6c3c0ffb050e0a83e189
SHA256ea35b8a865ab8e1cf2c01d5f534be6a5295573e9b9ffda9987604a927ac9699c
SHA512eaeb8a0d1a28b3d148c4e1d2107a0a6d2ae0b6ab234c96d221facb9f7b715111dc49810fa8d6edae94f1c973029d6eab6fa01d0482b1a157b088b10ceb5199a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a730cb7009d6fe569a12ec3446939302
SHA1f1448276dbffad153a6567fa706f39c7ebb85f8f
SHA256445c1e2653ec04bf259b5c694e734e0b72d794247b7904cec373d0ccde0973b8
SHA512cf955e3d97e25bb0513b9515f091f6f02d8e60e240caee22db3b7ddcbb638ed187411af158cb5866b2d8b1a05db12778c71f939c0ee47109d29ba4c68a5c0fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548408b96f822bfe6471186f376a15a93
SHA1ec22ada7e8341e9cf20b55fce57ce28073c77c9a
SHA256b7268f39b53fe9302557dc631b9ec6ff542202937aa943ef596dcfb35a521a1d
SHA5124645948a93262af89709fc7817fca980c0999d2883c079666182c06ec96dec25bc05937a7a427b9912e0426124375c1ecf8cbf7c488b43c1495d72a1895ba59e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502b1e1f2d055f1e29a9a2b6f8d21041a
SHA1ea39e915a9369dad2637a58f0d1ec8adfe288698
SHA256828c220c45f670ffa609a38c999eb2ed0a8564eb75783d291048b600f4da2e96
SHA51277040a5a5b7e1919f6bc35b758b263fc673e58380977a82be6ced43b73e3186d1020f908a6c7cd5aa240b42b989f901d6d5780d625748882eaa2509f77bc8f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545162c5e60045cbf2e1003bb0b57fc72
SHA196c42add0ba4fd44cfd254c3eb5073697f80fd8a
SHA256c923051e53df613c50ad7326bce9edc2a6e43dc62622ecc4f634e6240f5253dc
SHA512e040085e9f12436fe86fb65f1a7705352370f5ff36d68a48b4d0dce2929db42a774cf3b86c3ee2a865ecb60c60044343a77b4084ecb7b41b01a2b825e480efe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f1f6f0bb6e782a24093eab19ed742af
SHA12497a4e7abde6ca840a9d442cd8a47ba71d04ed0
SHA25694e47ac5d01edd9707c23aa6fa322e16a16fb68363221aa1f98b458300836ba9
SHA512e87701b05091fc8021a73be109e7e7b735f19b26a15cdba96d6ab1fa62ee783166a8da15c5855354cbd49af90ad6cc26406e69fe10f2f09a8bc5ac25dbe4d3c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596ff0aeee6f382e82d2497bf8436384a
SHA1fc24fe029fd1c3d5c83ae2ca7645b8351e22e041
SHA256880958432841e0c45b39435facac30f133597a8454b6a640eb6707b9f20971be
SHA512047d09612ff6dfb489085c3fadc4f6067e9f5e684fd1e885e7fd6ceb46315f33cd8a9f2710c97d33ad59ff00ade49f93c5770a678dd850ed88070e276e4292bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ecf1138f0bc9888c8669864aabe0b4a
SHA1e5981bd41ffce17375acda04b9bcb3098c2e54ea
SHA256834ff5ce4d8f8ad6db15e4e8092325dd10197a0b43b326b365f5e84cc2f1c8b2
SHA5125e7491973f3d6e7c27b85745c9cd0b0e6256a6c17a2d951b2e6e2df0e6535a711495c81e99faddcd0bf904d281c07085581b608c954c7ae00a4451faa1de6dc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a