Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
66647ae04cdcb1f483fa468c0a1ed662_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66647ae04cdcb1f483fa468c0a1ed662_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
66647ae04cdcb1f483fa468c0a1ed662_JaffaCakes118.html
-
Size
460KB
-
MD5
66647ae04cdcb1f483fa468c0a1ed662
-
SHA1
cc67e6e73acabcb793fdcf140b9540eb6f8c9d0c
-
SHA256
9a84b6272124934f85bda3899910792079da3e061c4d206fbeb8ecbfd09daa0d
-
SHA512
8f2f23db5daf1f6ee2be20328cf5470b906c3b110b7c334cc3942f3cebc3f60c24cface5f5cf680cc1a062b66b11d8c49a3d327e37b532bc4caa29712c65bcac
-
SSDEEP
6144:SdsMYod+X3oI+YPHsMYod+X3oI+YJsMYod+X3oI+YLsMYod+X3oI+YQ:S5d+X3dr5d+X3P5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d434bc76e885a499fa4557cfbce80660000000002000000000010660000000100002000000056d0a473c64e7032702e07187aa0ca1c3b27b2ed277ef87b8696798187b72daf000000000e800000000200002000000051cd87f93015cc0eda55f6cef384d980fcdfa8cf270003c6148abc93b593ce6420000000933c2bcc1b94b06d4c100300d0e4b37117f9c4b17ce818943142977510f85aa2400000000db62dce78b58eed2bdd606b9b2d25a31408b6942f4d3e94ac2a641a5ddd43f5fffe1899dc1cc0d97e07d7b35fec3a97ab931b5996932ff60d531a7bbcdcf5c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422522996" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDB00081-1808-11EF-B5E8-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d434bc76e885a499fa4557cfbce806600000000020000000000106600000001000020000000ba2c2cd9a9c54a12c4a2bff8545e17f6489e848eedb8b88a46b1d5ea5aaa852a000000000e8000000002000020000000b2dc127c2ca7d084c7538be4938d0a793133c10266dd29c47765dd22e20c24d0900000005343d6a7849ea49f9b3ef60ed93c5776b5f0aa2d044c4d67c5a27239f1f3ac9aae189239d5661757eb22feb133d3733429f87be9892c974aa22c715539e436c6ed6ff0f7cca2ffd21a59afd3ff010c485fe61b55658074400d71a93a886abb4ad8bdb770c4803d438f7e7c75fc43d1745216a45df7b8a9655cb6cf6e8ab8df25bff10f18cdc21558b710bd93e75b750c4000000016e234307552a27cebb9df54659fe42b4faed543a4a849ee13a92cd1338e8dcd351597b6a3450f458846be787ef35726e1edada7422fee71d908bf58d9537ea5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f4359615acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 332 iexplore.exe 332 iexplore.exe 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 332 wrote to memory of 2912 332 iexplore.exe 28 PID 332 wrote to memory of 2912 332 iexplore.exe 28 PID 332 wrote to memory of 2912 332 iexplore.exe 28 PID 332 wrote to memory of 2912 332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66647ae04cdcb1f483fa468c0a1ed662_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0f98fff3208af061fd0f5766ab5b599
SHA108db8967637b3f7f42f36ac0d072723ffea285b5
SHA2569209f3b41b0b601ce84cd3830f1a7d97a526c94949509c2e7d33fcd23fae7a46
SHA512e20461045e90d47cc3f60e64f6560818731457a992df4b8bc8849771233c6450d0f252fe755c7fb93161c5949bb30e8faae12baa20f0e03ff3eada0277a0312a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5771f01f5f4588df74ee42ff9a677281a
SHA12f4f3663417a08fdf6e52528a880b66968b9d89e
SHA25612e696423554278455eacc5e64fe4e0e5100318538ff04dcf231e40ecd83e886
SHA5128a666a09e67f7895609ddc889039b54a2f09488a3ea83753599b93d3859218a2fa5ca34d22a50cc5b4ec867313f5b9928e4236a53048c8c830d83f9404c3e317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c16d3351e38b1bd1ed1cb94d4fc0601
SHA1b6eab9273e19f6da7612eb6a2f56330e500a1587
SHA256e2303d8f2c572edd4161fb63032fcf943e0534fcc6cf509807d5821d65017af0
SHA512b529167fa236094b472d3faf7a1dee6516dfacd4286166b0b1d01e6a5981a5cce8cdc74b06cb838bce3e809723294f5d359241649fd70e27f53faea9ed66e8c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f4dd12411c1b24c36f7ef52f435b325
SHA13dbda071d0452a4f2c538f05aa2eb9737843a7da
SHA25666039bedbcf24fda97a4b3d9665208e9c14f052caae429a6b5895d6b36ed738a
SHA51291ba0c1edb38b0279dbb6087242d5808470d5895fbeab4f9baafcbeb00acf41c5b64010d9325e3be82d03c565748fe6577b5355e12c0ef741055109b765eaa97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a8ffa4eff069a7ab87d072e5471d74e
SHA1ea485be2c644bd74b9dabe58de31ecb4cabb4526
SHA2565e6d44af3314a5716b508e24c1373808695ccfceb69d5d679437cff8bc6379c6
SHA51247cc7df2adc3500b6d2330556d2f3359a3e8991a8c61bc64f3a880d3319fbc4523563f12c2896bd665b4581059180776a7c54adfd2facddc92c0cb8268c9374b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e79b1c4f0a4efde963954c0ca0c3530
SHA1b2cde601594d916ba628ecd763c14257e27b0c73
SHA256c9790237e47bc3fc9034184e9fb10302b267466e49d47379c8bbee4ada2324b1
SHA512cb35b19db6cf496a782baf3a116676b69fdb7d453874290457d904a03ba4281f3a0c4991d042971896b74d0041bd5b99efe15940e5eb16f7b44e0c7171ee94e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c071f81696614a1469a42b17c46da7a
SHA14446d60fdfa8203fd3dababeca661e8b91535f3c
SHA25692c5922ccc2eab35502bfb44b7198d2c974a9603a172a953977fcc0ee4edc247
SHA512bd301a34cdb8a6d0a869a4d60d0002b8120a72d7697688eb2d1212382ba64fed741d60155ff7728390a834a31f13fd94fee5233c59fc1d8ed44e97277647ea97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e771f27c666b16b96f1b5478ef4d1b24
SHA1670f8c490234e67ee4e2ba0acca3fc21cc105ebb
SHA25668cdc37ea5bb867f890b9f6b68cadd2003d148835150201ecf401ef620578218
SHA512f673366673f864109571cb4c35d859a85c61ae6d9798f033c47e3d48a9d274710bb574ad71da05907b122ef3c93d116e47a179d906e93440e4af588b2756c80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c80e5bc191dc6bd9dc0a499059c8ecb
SHA154255ce8b145883f26446cdd955fcbd5891745ad
SHA256037ffa3e253a1e377f528c55a279f5750abf4951f6fa1cc81a4e9ef7613f5a4d
SHA5120c1f151389f0f77ccbeee98d5477c281586c50073b7b1a5d154833eab51eb3670593fca3676fc131a6509bf5ddd2448d94a3738df8e4a5ea4b05f78a3b6f748d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5070431d143d758afb7aba2ef68861e4a
SHA1350f411d8ef3b55377cd07b9bd7f4aff9f966743
SHA256c25ed4fc8f8d241f7a6a1b9e379758ba23c9fd92e57c0039addd6aefb000f3b4
SHA512bc18a7bb41bf61553fc1ebae7850a244e22ec95dd616fb2e48ac46e022466c2c07cc29988213c53ad753f69a85f5dbd4d0a4e8f3add84392974aac7f1bbeb7dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c49fd00ae6f17b6a37711e21adab63
SHA156ac7df58285059a562a46c4ec063da4436b8fea
SHA25647017e7485e72a50eaf505cc94c326028f889e669df53c98e861bc551617e0ad
SHA512ea3219d80148c01a570d955993cfb95ff7a7613d3eddc3a10fadaa424ebab60f0a6b04ef6ebfb18f83b2ee9cb207a4fdeaa5823ba34b6a413577b5165da7be3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c11bf0c13529e84013fcf1a81f9aaa7
SHA12640012ded85666b7892ba3f57a6c685b5d378b5
SHA256eaa03c59b464c5504db98fa533dbaae6e9fe19f40ac17b5aa152e3ead7e25c48
SHA512ba1dafb085ff97a89fd534b1a3773ff6354d45da2ad875cf7776df1fcacbd3dd8289be4eb9b8dad85f5e2c5bb0bef166ab86303686e94cc1baabc3dfa7a7e32d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563868873a2a765d4cce8b4bb905b092f
SHA19171e72c407ae6ef0521133ccabf50dd1f9d3e64
SHA2569f2b51aaeab84881ab7fcfdb2a27c6f9f3044970ff7501ccb5b77b67bf9f4313
SHA512a48d5e187822acfe2e883ed4348097149be7fa90f4aa213c3a749dba6724271346fb79e8b091ac63fe20b3d621109eebf4ffe6d74644f98689423e4cf85fa964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f652410d50cb713c968b610c8db838fc
SHA1aca3d6b043c7ee289a9997dadd50be5bc36e4b03
SHA25687e08d6d1a06abbef55aabaebb616d2772bc4539e151c9edd6312bf79ef9dfbb
SHA51255ab50a3a923e862840d842dd59ba83e940d20c050477bb280062520afca43301cbcdfd626298f88bfbb339231521b297b01a10185a848d0d9391151f9c55f14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed3d94fedc0971073167cc80903ea518
SHA14f90f0bcd4185faf9c3a94ebb4b2c5f2b1438d5a
SHA2566e2714aeebd8b51fde7cabe6532cda917d0f782ae4b80605c78fea4fee849f7c
SHA5125f5769428e09d6d1cb618ae450c3744d659f1116b07f2bd2957190306704bce640f7732f987e0dab4fdb84ac77717efbb3cf49403bcdfd125e75153cb5449cda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d0ca0f90a70e96c1f570dae6435d3a9
SHA1d2d2c34bcf6423bd9f5d54e9b1a533a0a821159b
SHA25654e4f08688e279f1ae02de00c6247ffaaec12134ba966189288e1ee501aaabc6
SHA512408a2199465c6b1b71442a6ef7f91158a8da077a6e9e946bc2bbb8f0cbb052f4c5d7ce9c0900db9d46d74c73f7c6182e954834580f4cc501c8a25fab1417afa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571fe9341de8a01e143baecee566c18c0
SHA10869706778c970225c51a5e19a6bedb666678a4b
SHA256d1a24a626aafa73e2ddcb4d164e98331c56100b0d584350b9ecd19695aa140a3
SHA51229928215ad436e9690e450da99e9633eabc092d740f3f8b25e7eb26855af93c4b4d431bd905b8f3dd03b65c14196d546826f33ad1dbab9ae2a03886404760040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b4ff7d4f895938beb873610d64068bb
SHA19ec3ec82365963e72f24817126006671b6868a7a
SHA2569235abb39622569e2270f835cb163f24596a0d39cfe04d6841f115ac4e07aa00
SHA512abefe2e68ce2821d86774187d788284e8db877cd2f20b6f22b3fdfec0922b7bfbe9971a06a5540aa6a31cd7251fbbf9fe2f54f84ccd65a52fb98eb8cd21431de
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a