Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
65fd56f3b399e4a8818db3652572e7b6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65fd56f3b399e4a8818db3652572e7b6_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
65fd56f3b399e4a8818db3652572e7b6_JaffaCakes118.html
-
Size
4KB
-
MD5
65fd56f3b399e4a8818db3652572e7b6
-
SHA1
37c1a91d57db7c13b3409aca4f5334bbdad63b0c
-
SHA256
eba329fd587293d2d88215d682af56272a6475c521b16646b84566e933a95e07
-
SHA512
30f2a6dcf651cf09b6853aa0fa889aa1e747ebbc038c69c16ed9d1876431c005aa368fccc6c6b3689f15ca692eddb8fdf8a73106d138f14f882ad4ac92568b50
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o8Ppd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDL
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904e021900acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000001eea853c43d44478a71e82e68e556fd000000000200000000001066000000010000200000006e258ebf56b337fe2e7e20ea86b17af18c4b338a4ee4f8af0f53f29ac696a328000000000e80000000020000200000001f28f132f3fe92626471672f1a4957f31a568028c9f3bdf0a48fdcebfebf346220000000719fb07cc16f947345535288c5dbd3c6b76b97ffb06da58c41c83caf8549086a40000000954a98ac063d00e3aabc764b3b46be1cd2969c767113a59aaabb8767e0d7804eac3d5c9ed40e6fce394a0ea644796fb44a49ffffdce3af870234685be4adf454 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000001eea853c43d44478a71e82e68e556fd00000000020000000000106600000001000020000000e3d51a57dc3cf6c3ddd1db871c96d3a7f73e8d128f5465a126019742b04af0e1000000000e8000000002000020000000efe00f7cdf223f3f6e9f2a2c307d7d4ee77c2409e1f86e31b9e4c7b2e024ef809000000083af0dcda3d9ace17fda7cf21ab001d5aaa0b20c20be40a5311d5d94fe3785a0d87fb889d467ad8e64c73828130dc23ed59e99bad01d4ff4021edc1ffd77106b87d02e23274f1714d8cad0e2b4aca875a200a6f4a197f5d202f03462b099c3af4c548916058bce176e448a66e25aa1fa43749a36b8a2f7d9a77ecbff072caf36eb73afc69715a771a1c1ab469bc8b10e40000000b115eaef4df8791984e2341cf30467869e87b09a2493dac26ecce294509d31059f9ffd60ec55b1a1a4aadc7800bf95bdb8b305bf02924d9f614a01cd84eb4349 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422513774" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{446B8E71-17F3-11EF-B85E-52C7B7C5B073} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2192 iexplore.exe 2192 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2328 2192 iexplore.exe 28 PID 2192 wrote to memory of 2328 2192 iexplore.exe 28 PID 2192 wrote to memory of 2328 2192 iexplore.exe 28 PID 2192 wrote to memory of 2328 2192 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65fd56f3b399e4a8818db3652572e7b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535a5958a0f1e4b79ee6eec889eeadfd8
SHA1386f7053d4de11643ef13bb4c1c4d5050c42e7cf
SHA25643476eea8bec9c5c10dfcd325f8fad0c53d0affb50cf5cec72ce3266a8d50c8d
SHA512760166a2d81ccc71d244e85ae042dcdb3c2e2ab5345dc02fe92534401965958323a9d2c62bd694c8c5601d0f9cf20810ef70f74c495cda5379cc28f4eaaf9d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a42bdb1aff7e7325905d06d6ee83e8ad
SHA1b53a54977e021a7a803e42d21c7be52253cc2027
SHA2565862a63e50aacb4683d83dcc8f7d5cce1f6bdca4a273bf6e0f8f4e585daa5a60
SHA512262e89fe2049baa84f8f627db16ac2df813dfc36fea4d1438809163df71a60f89fd2b510cdcd88d9b3444bc3dec9bbfef782040fad1a789578215f442e3f69b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a92d0a143797f91037e055355cb57948
SHA12d91792a1ba644d8329610c1996e213e6aac7083
SHA2561c93155dcda3d9f3564e15135d3575a85d7be726deccbd84f0290bf9a08f9acd
SHA512a9373da1519ebe8f74cad1bf6d033293873ed12a4cd00e7215fe574df60ec44b5279a471032d2541c4cea99a38852424987f546f378434472bfab0958540bbf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbb255493319eabc579f55591166bee8
SHA16e10ddafe5d68d14638bd118fc861820ce2cb1c8
SHA256521644afef27598bc7c705df0cfe2640bb9ac318f14d2faeb401513a7883c214
SHA5124067c248ade90cbc1fd69440e8b28d01844f798412add05695f385ba034325b21bb4eca9369cd3afd191e8a5d75be2b0ee4b98a2b96d5b75b641909b69acb2f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5116af30d5ed4e8d9237cc9d0075b6e15
SHA1c5af17f2048466b65f1665487238786546cdfb3f
SHA256bc8d5f18b6da69f1b1ee7dc5d8d66393b4e021a6f5b968664ae06d55ab7efbea
SHA51277fbe92455dd4c2ac5f2984a2c1f2631b09fc2d529817350cf91662b61784972435fd2025dcb4bbed15a3c4fa5b0c53dceb105adad957990f4d453663f6eecca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4aa65a86fbae94312236419bcec5365
SHA1263ce0bbb7bf1fc721d9d79e7710fc97b5888ba0
SHA256f787a806acfd1557ce8f3d179d7353a9b37d886996283c973d613d4e1b52bb31
SHA512ee9cc579b61223bc7f5f6a858b385211d86fe47ca34c43f5f1ca4dfaf254c1431e9158c88e6d1f38d0a870ca7da67cf69978e8ecfaa1a1cbedac20666e98b649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a2dfdc709783482feb12626fae1aeed
SHA1561f3be180ae0c5a32c18d25a712a892ca272f97
SHA2560ebd6255bbb31af003c8176d1131c7aa7f30da3da942c1fd398a1208471f1b36
SHA51265ce3195b66d49a68130335b7e6c20be05180ad2cfa1e32774ade6a1843d7e616302a5fb18b604db1fd245fa06542c2611a68b2a0a62e0b7046781f570673fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ffc152cf695c955c98ed44102067659
SHA1246e5df38670c058fabd2c84148d70a79016cdd1
SHA256ddb4aedad2fa316644ad45ab00010b2e173d0eb798ed43fa66d471411cdba3c3
SHA512cce23fd6ed78dbf78489f758501ef4f4e007d45f34d3fe92ddd3453e90e2525d5bcdd65dbc39d2ea44fa4bf0d18c63db60c381dce598d538186fa125a85f49be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a4058a587903e43e7a94117ba78b0c
SHA101e64722717fa6c275f2fcd142288a2bf6f56b17
SHA2568c5f1d54cd988fcc0a42e324d0571ebb77de7151c499db218a6d90b833280cc4
SHA512702d00ef6c90c36416f49e1a3f23d36e2375a6b9212c673ab1df79a24c96c862ae6d89fb81b1121b1a7177358078bf8f452ce7977ba1d359459e916b59c266be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3b52a59665d77f6701e1840e582c79a
SHA1446eda044bb106d733bcbff94fe24e16143c1e28
SHA256486718882fc359427fa47d9d8f392b9e7ecb3e52158203ad1d17a38953ecd030
SHA512af7f1a2ca26aaff0fb0aae622d67e033e4d923ec26c6ee18a8fe10ceb80bf3a11f84358f327ba6056d06b6e54482a66bef50313dcab39d77f875f655cb55bc3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9114c017b823b48f4bfdbb1a3098349
SHA1ed74da347cd06d4d776388a983b7258d7f9ee218
SHA25634dd125fc8d9ce276ba99f13ae8ecd0fc09aec8fae10124d62707177be5a3a8f
SHA51236173e4f5696e7cef274a7a809df9f3ca7390098ef7c82a2732a0e3845c0fbde0858448a388d44534310429304a6dc7d3564e634a74c26a56f3d42e35e5bd937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e900395dc0f178d468bd89fadb013f6
SHA1ed017c7ae86774380c3b6d2030f9473362eb9366
SHA256068e1947fcbc5cf577bad0ae1db0ecbc9be7561f57d3ef0c129f95aacf16bcc9
SHA5129215ea72eeebbd09491333614f2920bd403a942e2957f8d2c8bb8d4d6f3ac4e3dcdd69d33171bd3f85b0a8f5c88630df75dd772fca53327b3db79443faa7410d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50451514d679ac4352fb7b8fa2c32e10c
SHA1fe59638f4062956f01a854b36429ec733adff018
SHA256b992bf86e7a4b3324b4872cd900a44edaf835debec16079feff6c2b18b9c49c3
SHA512cb9f7727faa90dc87e7b8d5b6e7d3a90622352231680b0d154a265c0299e699fbfb5eea0c20a40f0b15424357e55512cb4e8463d039b6daeead6d09e720b79d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd136ecff20b224d344bb57aa4d54f2
SHA18774dcf5dfa530c6906ecda325a4ed0bbd27324f
SHA256c460ed8e5f3fd6389078e7cd3e8cd2517c12902558e6d92a97f7fb7b768393c9
SHA512b53f8e6de98dc8830ebbc576865e279892beba4d9865bd5af23b66693bec3ee866c66711b8368580eab1728d3f9def6933a4cee57cd69c06f274bf4daed01667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5bf51f170c8a466aba56cd2eaa55d29
SHA17a2b31654e03c06e60c1b71ac2a2ca666d553e43
SHA256bedb4bd2822dc47dbd6bac98919ef0d1c04fc667cad47b6567192538edf8017d
SHA51288d44eb707244a0ebf58e723d85c341d75f279539ab62f364b16e014580767ab333056912969e07bbc6447843946ae00a126d8874f1dcf23cbb8b4c9820f4adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ec73a8247cd81b2aa5068a6f00fa265
SHA133789fec797eda7afee8e91e6c21dd69154f2a80
SHA2567af3f8724d2f4334e66f95b5ab6de8e6ac2a806465a964126b2d51c86c9f9055
SHA5128a314199dcb46fcc380b03fe3e80e2ae78da7629a18c107e4f8c9ad5824166ce083849cebfd0634805e451907f03401b18c6aeed0d8f68420b4a8dd250d33274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5075420581bdf3b5903161f5669cd20ea
SHA180314dfec12d2547ee5a7f444f918933a6cd6763
SHA256e821d9ea722b488588bf59f0f403d81c4276e14446e9c27eae584a5034bb1a0e
SHA51201c109bc66c64107c947690c7ff655f06a9be42a43f461845c79cf1ef1cf98df37224e685afdf9915fd173836168dffe726542861a9388484eb070149488306c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a