Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
646df15b9908617985121d7a4bf20b7f_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
646df15b9908617985121d7a4bf20b7f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
646df15b9908617985121d7a4bf20b7f_JaffaCakes118.html
-
Size
794B
-
MD5
646df15b9908617985121d7a4bf20b7f
-
SHA1
867e58810bcc8a24978d8589176f7c2a5d6ad340
-
SHA256
4c6352e0da0704de159193ec0192f69a28e7db09579cb97f1aec2cc9600229d1
-
SHA512
770dfcc180262c1696e7efe0830713bc8cefc405ba2004b07ffdbb603053d312fd33d99249359fc5aeb39101578e8a168394f560f01414023b9ed2b39f6f31c8
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005ab1e3b1b405046b30d65343021e59b0000000002000000000010660000000100002000000063c2893a33fa3030313679b3e44747c066999898cbb82b1c1a526c5eeae917f0000000000e8000000002000020000000ed88ae788590f8813d2d4c59ff26b333bb3ca19153d582cd5bbe91c42a09e13c200000007eb328be3a60b6dac2035d58f06b98a99d0cab54deffe5352e8888d28363fe4e40000000456ab163f075dbda683da863de16b04711d390764c3d7975bba50f5987a1fd149c320b58ab7cc868554cf07a1b3c449c730378c24ddbf38b4e47db66696daabc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b9bd37b2abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422480326" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005ab1e3b1b405046b30d65343021e59b000000000200000000001066000000010000200000002b12abb24ba6679a837c3c6be11eee66d4c4f4cd1ab77e14c3235c0cd7d2bd31000000000e8000000002000020000000c37b3bfd1aca262c08dcefad5f477731a805843bd6f7b34beb15b73928fec8d990000000c1c05ca8cf7b0ab51143a0b5bb04f35c131c10b08495b841c93fa5564aae211d2f616432063e56cf32dcacebf1fb45a2288c1f45141025837b249b9885e9b3801a65e23b22b1490c8d313bf6ca9f1f69e27d8a955947ed6b2f523e0424ef65b12a5cb5d8088381008a699825d92e193b93a342a324656d5e78b77ffdc6d85aeb033c192ae831c779596e2d3fcec074c040000000b0cb228f6b0de696ece7263b0b41a16139c20807ff723abde844f4290cd41acdc54ca77311224beef766ca65e91054c191b3ad82aa4a1969aba6a811cc956940 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{632EE8A1-17A5-11EF-A6AA-4E798A8644E3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1804 iexplore.exe 1804 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2856 1804 iexplore.exe 28 PID 1804 wrote to memory of 2856 1804 iexplore.exe 28 PID 1804 wrote to memory of 2856 1804 iexplore.exe 28 PID 1804 wrote to memory of 2856 1804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\646df15b9908617985121d7a4bf20b7f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5128997872d0371dd0030a556f69536a8
SHA1d959a6b6c8a4a102ac58ae3c5408e53cd9fbc9a6
SHA2567403157995bb2d69c871f430613e8a0eb22f04d7c29bcdcd7b423c5a39035b65
SHA51214b4fe86a0625d87ce45e5c98387f8c33462fde44528efd307e2d7404cba885af2b95f7629f38a85fdf093983649394639f6e77ac9f584fce65bc782e64c7c6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e32e5ae4aacc94a9d84cfc864391ea7
SHA135894de4bb26b11fb1f62cc11b1ea8944278a09c
SHA25655e050811d98516bdad7d903058e254496593b91d65f08fa67ab572d0475d18c
SHA512ee93af6c3feb2d199098cf9834f9ad1174c11cbf2a482615a3ab246d255ae687cab4d0d93b8b2f3af799697c7d3db9fa13db0a83b0d9efd13320fec8b900b6f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c433afbc63fc5be59333688abc171aba
SHA1b6633f6fc67552778a05c92f01dd6302eb8fecdc
SHA256b5d09dab37c7b9acb7ceacbb4260e35d4d7a1998b0f2a7ba275ad5e992dbcd3f
SHA512bacd02894960b31e2a97dd845bb027f247915fbac7c057a3644d828ecc127d8f549cffb8c88962319b7376a710fcd9c2fc9e60af061f0498fc1829dd0cfd3a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a95976203f391c390a85359c358845d7
SHA1580a7f0e678902a5eecf905e69d866ee4ee8a34d
SHA256c404d80fa59fbfd8525e6b191d7e0081283b95cac385da649a055855adfb1fd7
SHA512265ca19151e29afc4949bb4545b0885f5820f6840850409df46004eabb1d456c1b892bcead7e9e29cf1a3171a7abc7832402d12ecc30f250a2cb5438a5f1b467
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595e04aa234bd807b11da2af738daed3e
SHA1480f11735ba25e729e83524cc27dac05d0a6e614
SHA256340ee47e697e81581c949daedd65719426c73a5d85f793b0792e937b3ac8ca5e
SHA512f9cd0e4a70ffb04140c171382eba9c3c169f90c6c63e575d184b6740653917975ad5f65c578a9d9f299753ff5198d8ae8396bd913965fd57726483378ce93499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51078bf4268217e9bfd710a24c406ab90
SHA115524a971d83fe19a598be8ce4cba68012d377ba
SHA256111320f08b1f4bcd9fab0ddc138910868fd7a9b65a705540463523ef6523933f
SHA5125404ba6ba4a383273c26e880fc2fd9e207425417950cc452878d29a532ed013da1f4e0041155ea1ede99be5027444b9a9317bfc10496756730272d1f1f253db1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5768e79bd4a3f51e21352b6e8d84ad3a1
SHA158fd7bacb2162b85f638d85e7dcd0c121506e715
SHA256e0442cefad9f79789ef3dbd9ad78aaf411f8e4faa6796af4dc2ee056fb7806a9
SHA5123043ddb5df80bbb69cd2cc22cb075dd92a54f5b7a8f7e6021b493c2bf0462d61691edd8c9c357606e77fa7546c5dd99a045d7b86253d5ec92238a8630e2c6de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19a25889eb390c883c310b93ea3e4b4
SHA1d1a856c999bc4eca36c37d2ff9495f1ce0557619
SHA25630b4c661bf7c7f1c2f86fb849649a99a790c2c0346c63288423fe67793eb7f11
SHA512e8faf95da9a0ff1d459f7472429e1826fe9f277ac197142e31898dab449c07164ff7cb99d14df1837d62621c352603be6e1eb448104d946955ea3c89e33e1771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a20bdde90dffd7d1dabd0b791d521281
SHA10f55b7db077e94fa083d7ca8e842905534be947e
SHA256f949ccb8f48114ec7687495bb2b435d9c858c61cafaf4f76c7f5ed13666850c4
SHA5126ca197f5eed1cd005573ae8e5ecd5179bf22f4f55e08635f5c30e29f69d5ad2c3c51f737893e3430b9f03c2ff7a633bad47409fdd45d5ec835486331db96f78a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9afc9fbf9eaa4340402b52395407d9e
SHA1791a87d767de970779feff017fc71e359f8dd487
SHA2560213b59f6f3f9007c8c3ff960f3828e73c4f7dd5d4ef7f9eae03f74b3ed13cb3
SHA512dddd4cd17982620492295190ea5ffe218d6111c310d899f2990e03a6cd0799d744f204fc4bd29b90fdffac7ba6685d9ce0e0b98d441eeb2ed253211428eca0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f80a374f874c1caa07faf67074e2df11
SHA16799effa89a9d3cc0d66a5d1e8cc21571da78a1d
SHA25697a74153e1afecb04d3fdbfb7a89411d5f9e16a45ff592b7b14aac6fbe017a30
SHA5126e6868c0e06d129d7331cd032988a3168f7b88e5eb971c6dfd9abc7ccdc22e8361e43b605a4b8967fed65c4514acee076be286595f804b34f41d5c32f527e1f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52451c8f57cf6b1b5f6bdbcd5d10046ab
SHA1ef89f81860f00b7778842e039ef419412bdf5b90
SHA2565bf1ce1115c9eee31d0e92642eecc6f6c90cd0d5f494666757e630e689049225
SHA51201b22798dcd01cdc23ca3bc2f7387413e97bdf9d64273f960805903f163f4aacbbcd9c16d7701ddea1df3a1bf16cdc8f4b877fe0e7122e8abfd4fbf8610d7ed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cea4ff7ad28dbb083314fa666de35f4
SHA1609c0a116bcfd986c9d55796482abedaa6abdf7c
SHA256477f4a896bc808cba3c0b84e214e97d68a31d649ddc85a4f0cd55e8248cf9255
SHA51232c6c5a3897335159e215aba68ac87863e21b6c549d0454387006878c8b134f4788c7f080a33f62448c9f41005e692c210173f222f0d6cf5ac772a5dd147c21e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f36a741c65d28dbb87f7fa0b7ceb7dca
SHA156e1d470fce07cdbc78b3c98fc216691ccf2370e
SHA256535efd9ee3f8b0f06f2661c03db65dd6d77e18ef9a13ac6bdaccce23905d3371
SHA5120ee8bea8bb8ef912534d81d845b703bf70a5055cfa5e21a02f94cbbcc8c6f1a1f05dfdebdd5d19f04563ee6acdbbbdc72898d289fbb02302de4bf4d49db817e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848bf22f4bd785f0a9d78306ecf0299f
SHA10b508ab598c1ba8f1cf6e0a57c0cbdee6f49c94e
SHA256a16d76c75831b418ceb243fb8055611adaf34c5c49e7c48b055170a820d8a30b
SHA5121716ce5eb858ef3ac7e7491f48e424469dc7a666ec315308064145bb89df066eea16ac6762fbdbf0cfba4c65352a19acec0f28c50ebaeab0473590cb6c5c8d2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564c77b1067eb08cf561066bdecf28d59
SHA196bcedf6bcf51d2166ee64bfeca74f98bd511f98
SHA2568699a6cac67b88cb04d0547fec4fc1dd5e337f97cc6c41242a03a142ea074426
SHA512d18e31e69fe8ca855a36ef45d31b7cbde571b53d5393213c7ff2d1d1dc9f9af272681e97d9b8e502f191ed7654b281f546b120d3a8114412dbc038816ccb3619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5112323ce95faf2cc5ac02d860c47d973
SHA11d7456aea826a42ceeb6f0dee47490e0f807c073
SHA2561782ad9640c02e87fad9268e5dcdc421ce5bee8976155bb1584720ca08290ef3
SHA51273e96cd9042ef8e0973bc11e43c5c6401571aa18c1a0d56eca36e21f6299f5dd232c1e36ab800dc8d0c0730b9951404581dd050100067e5c6862873724c56e85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504dced29c4c4b79a6655eaf7a1c570eb
SHA1346457c2afddfeca1a77a98d8e6f83df6cfb6efd
SHA256c707e026d2b50fc2cd0931e9e9f88e101b147a66c98141183dfb382b38b9c161
SHA512fce30e4d6ceab9333b50c3764fbb965a62150383cb55ab0c09c5da15beb6378a7fb2ad2e884bb6296a74b75529eadd517119a4841465ae4181b38eded093909c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577084b0c456ffbb8d2f73925d4cc602c
SHA19e35f3b8d6b07ff9145321f9c7242e91c369e977
SHA256b41166557be1db6221a0f9b1793cb54bbf4e714df9cbb9c4761a32f6affcca0b
SHA512f82e90af2cc5b89282579895502a6cd2eaa78a2d6ed9fbfdcc8e371c6f55df20f55f09e04c8e46fe4c3f035a01aa8a8da923f5d3da88d27e164d06f92fe79fb0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a