Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
67d6b19d1ae9a5fd8e8e1d97cba471cd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67d6b19d1ae9a5fd8e8e1d97cba471cd_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
67d6b19d1ae9a5fd8e8e1d97cba471cd_JaffaCakes118.html
-
Size
23KB
-
MD5
67d6b19d1ae9a5fd8e8e1d97cba471cd
-
SHA1
3579ed8d01f8e2d509463cf8d56c221cfa257959
-
SHA256
fffd7dd53544fd0afd9d5cc5743b4cd355e8fa633a7da966dfca00bac7fc5e43
-
SHA512
953a4d07c901534414f859af06640355a92eccc66705f6f32ce5b8a83ff528f3b8eb064de8963811243639ea8bd448a383cac262121042a51872a00d9e85d642
-
SSDEEP
192:uwHPb5nVSnQjxn5Q/onQieLNnenQOkEntESnQTbnNnQtBXzvMBrqnYnQ7tncYang:XQ/igp+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d4d33862acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{641F6A91-1855-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab000000000200000000001066000000010000200000001d9e8bde7d8eab2c375a9d58d60455a4c9d16890792e148130a0ff5b16f82a60000000000e8000000002000020000000afd8ce65603429ac7eed6214c59ee1af2395c6b9bf169be134e381b7d979ebff20000000733f1f6651c2b7973e4f08ee1b08959ca4e20e7c78e8cf57229f8d855af72f01400000009e2385cb78c7632fc17323800b4b985a9dccec9f99569f2cb909b38127e5a41baeccd7b5a343e4631daf814962c8e48ceb6c7c5157d9074c7b400670aec1a9cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab0000000002000000000010660000000100002000000000d792a62e11b51952115f89ff31ee46208b0fc797a15bed31195a8b7ae901db000000000e8000000002000020000000a260e327dcb27c5f3c68cf5a21b5b0ddcd067688f353d39a554b64c72fe6d1b590000000ee5620a1f621ef0f9bf7c3d4c83107d7886117ad5b0f51064eea9a0de268876cbde2a58aa31fc9ab6a22e6677c91a038410448b95507fcfa2b494e7fecaec2ceb3435ff8403f890994041397274c68c0360d48f017cc9f29477bbdfd563ff4465f87dfaef875f75b62e4bbc22e65b43378152a1995fe927510ae727b4c7ff61f90f02e2db68a558b6d63fc02816859dc400000003439767194a0fec6504b6c50eaf9a025143eb3e49d008899ad49209f215521c58911276bae46a9c9a1f23287fa957378ffe9adeea56724852699478844cd38d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422555918" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2964 2872 iexplore.exe 28 PID 2872 wrote to memory of 2964 2872 iexplore.exe 28 PID 2872 wrote to memory of 2964 2872 iexplore.exe 28 PID 2872 wrote to memory of 2964 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67d6b19d1ae9a5fd8e8e1d97cba471cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543c64f23235335ee03ef50942d63bfb7
SHA18aa1c2784b0d0ea76f4ea37b320026d1d2219ca6
SHA256fc660d6171a6b8358b8bf41675789c4df3539a613d710da8babe136821de34c9
SHA512d9b159f690e4a5660a0db723834c811d935f91abe39dd74f957713572d7fa7e6ad380d92342b3051a09317d85fee0da67d13011b37b6af642417d0a3ea3ae375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597bf980de3e1462608f76468c0bc667d
SHA1d08de13bec3470d4b0c0f15d614dc0c1c7791332
SHA256dc4380a19d7c8186d7553f5fdb1a9f7b0a01ad4d57a2c9b2b0a44b3f8ad10c61
SHA51202aeb5451a57036517672869a6f3149b235fd2180dcb00f95fd7a12c486b22ac7150461f19c5622a156310d2501c29e4d738f7d657ed612ec85a76c4f118a018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa3e650825373db1b84b16283d711f99
SHA16cd80cc425ddde8a12db2c45f6ad62cb3095d131
SHA256e7ddecc5c93d43c720984e52b44d96e74894d70e778352efbb9a067ca0c61fb5
SHA512c12a56fe4bd87f3aafd5fe4039bbdc3cf8668c627d559fce925139c74599084ac4daf9ab5737363957170e5af8e9e298fd9c61eace566c0d76cec53483b96b0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599b07bafdcccaf532876d9c1276ec6b7
SHA1576146c818c8aa2bf1306768992c3bd3d169893b
SHA2562c704acd00ab4cc5f32fcb5bf99206e22f5ea18fc0adc47b340b97d813877bf6
SHA51213d6ec3da2efd111e1c48a56a28846e26d6436ca6ac7c8387de09bfbf8f07913a56b38583674f08b18ed279963fff4896a3a39520003e321a5af136f8146981e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525c9856640b0fc46b7beedf22a7f1a97
SHA1486a76a6369f3a77dda96852943a5b5256194749
SHA256f60d29881f66aba3e9b944a2cd9b7eee5e1761af512433ac9bc3b208cceb2232
SHA51293229d66eb44f34bcd2f153437573a99fcd91dd6b9283b32f6b99f18d00dceaac3090b8aee8e681dcece53b413201ad81b3a492dd8c835ee0575ab074058b995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580dee6867ceba91f69e74507def41b59
SHA12310af9ab98c84a65769b5c1ab5c34bc26aa6ffd
SHA256a27798b8600808f0d30338f2ae1ca2aae1806a6390c637339c5c6ac33c38557d
SHA512abd430e83c35acdf0b2c33ceb0b4030c42be89da8dd6b92959489a981a2b01dfb93c65623d37392992608994dda171ae28eef325c376ce5e844ea66c14cbb6fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bca6c5119157a55684e547c12e224f6a
SHA1edae4ff65b2575a3106d03557ee38f0f24350c4e
SHA2563ee45cb4e98c13d14fe85648ca860283c594465dd478a32a78197f65d9613180
SHA512625eca148e7c7773b35f94094844a4c61e05b15e2695ace9911e7c91b4f1d51cf801760068d9c85cb8f488d0531a5f5823365ac45d5ad67a0dcdff748158a8f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4318938688c61432985927d8d5f9f47
SHA1149655629cfe5b3c6580739c2c436e1f9d4dbba3
SHA256688292686ea60983aa85d9857a6d41f70e2b66cf7a5a9383ecedba6b8f56da7e
SHA5127a9a65e9e4193abdb51a6f0548cd5d8183dc7d31e71be6f27254e71989b6b032bd2c732fafdfa50a6445eb1e0621fbfc8eb5036375b45e85401ef99c68cab208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d868bc956b938372e7ee62f31965e90
SHA1393ce77cace6ab0ad0700925f32440fd3bce2fb3
SHA25602f392b712cb64a06b528063c830c63334c2eb2f646f7adbf8aff70913d2fb0f
SHA512d734f589f374ea0f12e9e6e6edcbc065609cc938bb83b3796cc25830cf5348d566e914c2891103826ef4f1c9bc73bb7d10ae342bf6184e16d7e70748f3239ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3c7db40670390b161fdffa89de00ea5
SHA1c383d04f22a10c14827eb4b3653f76161c1fdbec
SHA2560289d7c2a4b2533e0f574cf0c22337e9c0e03409f51b576bbd78ca98d711c6e9
SHA512741a7a46996951603c264f421a577bd83013425dc703a28c23a3b675eb0d5d75eb0089cf14026acc18c6a3860d6189cb2a03a9e9721630e7fdc9cc83c0c26bf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547ddec929f1e6a457ac45ce8686829a4
SHA118d7224b19ca09317194866c1f5854d1e46e2496
SHA2567d5334349c7862ec8592561533312e966086191d8bd5384cbc6b516d4109a48e
SHA51248409306ccbaf7f461d8d18a79398e927a320d5bb9941fc0a58949f478c35b1cd26f5cdd66b6e8f45487927d198f7bea386b564385209060b1ef71f580544a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b5a5b3ab91b5f56149c9e6fa3432cd7
SHA15ea391aef5d5e6f072eb183278f8d0027f582e42
SHA256afb7e2c160cb70b62e807dc691fa2e51a1ad594837acdd2ad3d25cd5424efed4
SHA5127844f169828b36ca1c60ab41bf592dcc015b5a8ad0d6e706082eb03242ebc2a83d00fefbc749258f1ecd3966c5664176d60e52b3fb270c2acb5b2a56b622a380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593a0c6c4493e75332d94497e3eca0094
SHA103be8230bea1951d88483b941756e77339c581e0
SHA256746f7c45cd09d51a24e77b477418c83ed5e50fff0c4e1ad0cc5a71b001aa9cdf
SHA512ab688965b80fdbfaa7754a30d9262e3bbd7dc7924e7882b634700b0a50aa3543219971ad432874187315692753825af938c4aaded9d14bca0477d9b2e746bc04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dc4a3ed5fcbc23bdfc7e2cbbcb60871
SHA19fb659c7fafeafe837a25bd11cf778383e122a41
SHA2565815b8df07197bb00920720cb178bfbc5643502ab44b23524761282522b55d51
SHA5122e93842b9594f333ef0c74ffa7c59396c111e0b8806d8df03991d0e59c5714f3a56eaadc1c6200119782f1a3e79d100e7643dcfd8a05c673733288dcf6795fe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c871ef1ea60844e38169f254ad2f730
SHA19d112e5fffda71c00d70d9b57c3599b2f2fc2cdc
SHA2569cb75d79f2658996f70956e4277d38b5d176d9c732ecfbbe8a5b8932c7c04762
SHA51259d37f488d6123580097814fc429b542b9316a091e15521ce1f53f1d8b1545f86a48ccd0f72295f7f43b0ecb43d60ba334fc152dc2734dfe747f6475a2d8f77a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af4d690e5f8a7ae4b05e41a6adaff30f
SHA1721a74f3662c87e0aaa775d4c3d1dfff3a540190
SHA2563aa4ef09a972b0b06a750b87d6836e424bc85e198c148db011b3eedd2a30851b
SHA5121a64a79ade7c03d85835f82050099ddd567c275221be94e6af62854c67cc808ead38c2da0f26aea071107ffdd99f59718c027ec22f6cc982a148742148bd8848
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a