Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
67e93282cdc4b69d9d753a8033c971c5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67e93282cdc4b69d9d753a8033c971c5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
67e93282cdc4b69d9d753a8033c971c5_JaffaCakes118.html
-
Size
4KB
-
MD5
67e93282cdc4b69d9d753a8033c971c5
-
SHA1
7c4680af7c64adb88a45d05a43d79e654d931fa6
-
SHA256
2c4b767938f70418ccfd3123db40a9067f364bb1415c4e65b4734e0c07fd627a
-
SHA512
c472d6cd3780d3c6a697d6b8692997ee697f27b4499f4ba6d561e3a70cca5c0b1e594c78bab9623f93ae091db9e9e74f49fa229c72041fa8ba464e2945daf23f
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oDPZMui7:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDH
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103b67cc66acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000469de253eea8b4478848d6f1c3f2c16d000000000200000000001066000000010000200000001f99f19e510da616b619bfb6cbee8b2c23d7c6d7598eb4371d258c83c9bfdb14000000000e80000000020000200000004664d287ab9780f3ba4fa2213a1ac7774cf84133e81a5a04e268dbcd1e12e6f9200000001c24dfea0e6b20a7af5b29b4c3e74f1a01610ffec456456e18541d22be654ad8400000005aebd354201436d0e7842b8ef20d706cf105008bacdf2b6747a7ceceae668631b72f443957f341bb352912a21d048bcb987792be6a3210c16e36192fca20c7f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000469de253eea8b4478848d6f1c3f2c16d00000000020000000000106600000001000020000000ea0182518a06ec18262995dcb3bbdea8a4d98c8e0420db7526de9026a3a7b402000000000e8000000002000020000000bd00d81680416f4f669970ec1792a0fc4caf86bad19eacdf20b90c31e3c26549900000004ded6d140b09ec329c1e30a519565229a73f0f2901624f3793d88935a4c31ea06ae4d216724032df00889ed3f4bf14029dd481f0cdbb76023009aa73d10f4af7243aaee1b39066d585e03214fe79f77bb38ca465248adee5403864352c43eba73c35c73d7acbd8565ccec91fd94c98ceae552eb3872a84d9d4da981da555a072f8b93b8de89aa0ec4807581d9f127779400000008319a2a7d2e46c5ab8c8c31956fbe07e22dd14d37ddbf7a8d77d5a6656cf5b92c8ca4a76783add1fa72f1536f4be4ca221703ab2328ce0b652cec477a2dd5f8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422557884" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F74A0511-1859-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1336 iexplore.exe 1336 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67e93282cdc4b69d9d753a8033c971c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e548b3566f7afe437f0f9b7dfe2c612f
SHA138e44cd97c7a2c89a10303207ea9850edd248baf
SHA256851f25780cd302ed8474ab16f5b01ef60cce87543fb55ced79d97e72ce061bd0
SHA512a60a1904f98626073050470c663bbb0d3e027addc7161dd29b1a052fbd0960b7c6849a40f0d1761e3b456befc3d133eb3bd4f91971f08e642fb13923162cc260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e01b676a16eeea8d8ac7c5d43197563d
SHA158cd281bf3417db3d07ba3e0abddc13577fe3da6
SHA25697c6d383b351ebcc94e50bed24da04bfc2ff8a4b858021554c44f41f6148399a
SHA5120e976aadca054bd5aac895138e289f94192a9f223152c81b6d8f8066a2750d794c8248542577b5d21a780f9a81826fdaa46a577a6540b28e6826a7d52eb9fee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee154670777c6cc3feb5d7570f24031a
SHA17af6a878c6692bcaf79f18cab644a1a9ceb9b772
SHA25651c5955314f2fab0a09aebe685ddff95a05eaebb5ebd83b28fab58e31afa07cc
SHA5122dc42b6962d2fe5706a835ee021977df4250f81e9c4c46cee872a90395e5a862e42f4b2c61c96b44a95028e15e9a372ee0e9ae324f660190f5c982538b747601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8fad653230e966b2210d51f54976c9a
SHA18cd5e79ccbe74510ee8f7874e7e60c67f25852e0
SHA256152d8948bdbfed42582f92827013c34192bb4d1162c59388686b628a0a287990
SHA51281223be013666a2ca59461223b108e9c7fc0e172d0fe77f8cfeee0400e46d9bd2bd1d9566860848dc1140fa3bee2984a7aa7c6791b605712a1f68e7f21f0d82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592db831570cc1f7f145abc17093467db
SHA1ffabdd7dd25bd4d8b24c0a0e2aee1c26f2a81d32
SHA2565e872d37391c84dfd06f5c3f303a5f70c32bcbd42f76427b8e8625a7f2d0d091
SHA5129dac657df3a517cc48d1d3fce37ee91ece8bf4efc720ac656802d00f1cd262217d6302703ad0db5639b769b1a1d72bb5317ab14a754f01a61ae2d04f7e0c48e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572c0000881c6f1aa214aaeecea2b1e96
SHA1f92bb60680699be1be9aede8d40522c7b879afed
SHA25667d2df4180f4b5b2d46c3b2a5a7aaedbf94e2bfb97f9c3d0eabe53a6270313e7
SHA5123b48951d39d4396c9fe011a9ce69b3e8a40c9f3d1a05d24a65f6251e48ecb293d1d336b4dd4d444c55e453c22564f5b228feb978a0eceebcda3d64dd3b4a0225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578d6a241679de59fb64ee259b34a300b
SHA153c58bee9f2f67122c51d97b4fa2da16f4b4a847
SHA25651d6a6445c5e488c1e9a07625a160a6daa6770c458b89644edd2078db762c7f7
SHA512fe18e8eeef06cd98dc774e2eedfb850938d1f41f04da5dec9bb36868df388f5f531e5bee91d53a16a22b47fdd274fdbea768d4690e0a97989386450303541cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7c26550a41b52de4c9b553401240959
SHA1aae5258c8e97331e343c52e14563f77ab10ad208
SHA2561e1b03d66a60b6df25f40d9dd581d0121c571fab78a8ffe51fa4713624f6f551
SHA5122f45c451322c7a22f11247a1aed8ee016dce522ea838637c87619d606ecf72a4dee16b08d0a918bfc91d6fa53b66ff620cef8013c64269bc91f9d268cfef8ec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b254733f03502c7bb34154d75253f73d
SHA14c146a1e31178bbb17b55520b65530be8840bcaf
SHA2568b7b5b80351287e38c9e95429aa3dde5b6401ac266253157f822517e7c8e3e40
SHA512ca73c2ababeb01e12e0068b391e20cbe8b827e72c7a9f11c493edc94d5766a4b062aa2ead7f7ccb01a6d24e63dd486ac2335f38256ee1863257b27881ccacb9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51347d666c282fd46a1ed7f15ee7bfb3c
SHA1a0188d3c2e000485cc8c0f431f838274c88599c5
SHA2569fdd42b0f7b495738aa3f342a887e332c02544ce07d55c9c36aaa128c53725cc
SHA51217db2872c8cb2817afeb23a4054bc65b80c02a61757042ea1de83343cda527722dcf47ace60fa98dab49ad19e5872c1a421ad228e64a339c36679f57e746ad2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19080f184eca8b72034282522048d4d
SHA17225a8d2ab5b4234fa83ba99efda3cf4a68bd785
SHA2564fb47d1e170f431698d36eab7470bde5b6e41abd27b974b626ea092ec3b3ff6a
SHA5122aecbdd6faadcc519b5662ad48cb80f28fab3f03b4c7acf4250e28fc67aa77e82e8638fc18173a237c91bd0e07750a71c11fdd82f4f3cab8d39597881ce91436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d318245f0bfb0b365d6aa79f7638920
SHA162a77ee222acebbcad37c7b3ff07efadba067f6b
SHA256a50650fc6db06e8304ef3725601d3c196bdfb6b0cd80a7659e73b3d09770c90c
SHA512d13dc538b4ca5c676efa564ecdd3cb94071706917e65d8f0f3745f24190f37c7076e1c6f272eed19c2c7e3d9400d7209510237f964c6c66d99190d7b9506ded7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8314fc9363924af2392350ed31dabc2
SHA1f87ba9b18ca379ec09bc1f00e731423c997784f4
SHA256e68c52ce078f349d095c83290dbaa5d4da5aa275f9053ed97d2c4ce09744f572
SHA5123e9a53f5d196ac32493c7a1206ec8ec4359e33c843b1c3a334f1c857920c399cc08506d979f6a152c3e24c752497f2ff990fa71dfe56dca2afde87bc90c8f6f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556ed95cb84073b148323f58c23e462c5
SHA13d3e8ca55e80e2303fbf0168b595c11104c70a06
SHA2568182a39876bd04a3851afbaf298eb6e72e62118cf1c0423368718873fea0d7fd
SHA512dbed752b8bb5891e21d280476a279bc16f0354cd77fad7168e8bf83fe28530c1ceac952050071c2fc54784e1d0bcd7a1dd18b7aff8f2c00153098ab5fb7967d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea21248ba918f45f282b4227ce4f0d8b
SHA1eba7c3a5ee95ea918645ccd6fc77273127b8a9dc
SHA25674dea815719bcb022b39b878983df769ef5089d3599cccc8c877b33256743077
SHA51200fbf318565a1e8d561b2769f37f2a9e3008cd009f65241ee5ba019958075ae94eff63af4291f239c85cb30ae2be88abab7b4b739ecfcd39e6b2c93bfdc222fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a27a708747c006eed7dce3b6ef0360
SHA15286df6f4575d71970e71bc0442acfcea95dc34f
SHA25655e2d233ce25710a93d1b6a202d81563591a8ee8b12723e8a270ac4125cb0378
SHA51206fd534334404bdbd9cd7cf0cd2844419c728f50a84ab432ed7bb9b0dff54309c08c88df911e37432668f899b458f0204e08e86a79a58ba09844c5c2d0b7c26a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfa4e81e233bbc8e991d4e97bfb9f3b4
SHA139eb53a56bca208cef58424b283661f6a889b55b
SHA256def405218715fdd62ecccf92ecc10565869db76a7fcca6d5dff1b4665e3a05ba
SHA5129afe9ed14a0b731b145b1dd77af4975c3519a6376977fad30831a45134fa7571a0f00aa35082d837842e128ac53ec891a2143ae56d4eaaa809c63cb12143e5a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7eda033ca689da869c77338cd4c457a
SHA196d02a23514e0556a928626391c77d267744d33f
SHA2564db2bc825a22d6918171844baf82d559246919b05e46b3340eaf2f7139abc04b
SHA5127e468d1a7232f79005a7ed995bfa5048f543767e886e937483846060d3518a5ab88a8aeb85fc4fa78b74d0f9f05f84be620233585f181cce2df9dc644ae002d5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a