Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
6c5275e873dbd7699fe4e6c447e5808e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6c5275e873dbd7699fe4e6c447e5808e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6c5275e873dbd7699fe4e6c447e5808e_JaffaCakes118.html
-
Size
345KB
-
MD5
6c5275e873dbd7699fe4e6c447e5808e
-
SHA1
93a1f68bcad04f7f32d045efaf49d38257483067
-
SHA256
6022e7800a70b6d04b49c328b4964d6fe86962f0c8efb214795ed20733474263
-
SHA512
92d17d53d5a3b0a7fa07b53249295e7e4162d87cde3fb91f59a58f125019020fa668b983b0827c2fab9decd82317e8364d182f61ba67bdce5435a91159260b9e
-
SSDEEP
6144:S0sMYod+X3oI+YRLsMYod+X3oI+YKsMYod+X3oI+YQ:z5d+X3X5d+X3G5d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b76958000000000200000000001066000000010000200000002364a5b03877fb38e357a2977265f242f47020821ced61815b1c88c178756667000000000e8000000002000020000000c95ed28179d5977cbf2e441332eb995fca125911e5b49cdbb9ab625a2d125c69200000001c79cd28fdf14848f4b58d717f0ddfb3e32bf5aef73aae0aeb58b456e4509d624000000029773a33a59f1d77fc8db5d732128cf89a1a123979c3427ff4b3e340b9516291f82d26cc9d0766091032be261fcd5c96fc00e2b3d19a8fe063e579c25245ac8a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3007a08758adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422661706" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b7695800000000020000000000106600000001000020000000044adfdabd80f6a1d10ee163a3be219e41b0d22f2196ccc4a9f4ebfb1870dc8a000000000e8000000002000020000000bf336ffb364a6916784de97b42ffb17b54080fbb9b99255438380739adf9231a900000003ab6a68de242f65badf8febe2e167390524cb520119bd4b62c68fdf076e8f816b7d073fe33c84642aa3252a109882bf93543a7c3d6a330df32363875b3c6ed95585a5ae9a211f56e26c9abad9c11d7f09f14ff00a9099a3e1f8d4f7d822049c12d531e99077a5b2875c85942e1e032ac3a024461a3ef92ae9a7abef4d3858d7ce66185b2212e7d31a12fe1b87a958f95400000003b828a9d3b64d97cb38e8788ada84bed7ae0b5dd8f5fb099d051cbcc434c4115619b037fce19481bf796e176f009abcf53209e075cc49aac4510f5e7a4871239 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2E701A1-194B-11EF-8554-DE288D05BF47} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2336 2364 iexplore.exe 28 PID 2364 wrote to memory of 2336 2364 iexplore.exe 28 PID 2364 wrote to memory of 2336 2364 iexplore.exe 28 PID 2364 wrote to memory of 2336 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c5275e873dbd7699fe4e6c447e5808e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561793065aef4a981eb3480a52dc822d5
SHA1543102d484749303c26c771c07668b6c3bc411ae
SHA256ee8f7e3f57756000f42a556d5f9f41f767b8dde7c7a149e3f43d6a40057fe47e
SHA5122e14a9f03cfdd6d81a1a3a42a80a0504bb44482672dc043ffc628611631b07fa9524651ecb84daeb0d442a20fe041e8a82ee50c2fdd8d8add04d4db96899ec3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5843fd1ca7ab4db6a7cd5c7e36f14ae07
SHA119dd46f8988192c95565f24c7f9fac1d57745069
SHA2561525558ddddb1ff95124133d58a54015f7d81b7caa1762f96081e05e8bae2773
SHA512cf54a16eed6a9285fd7e42213d57e41732757fa4bc25f33c6dc78c4c98de6ce9d17fe4a753281be898a1176bebdf9c46e3bd3ea8356bd5520cf6e08fbea6dbf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549e439eab17e8441cc97b4efe0f9b5a2
SHA1c8d3f556ec2148d618f9f367ab36fcfa96d480dd
SHA2561a8a82f7e076aec6617f0959deb1fec8f450537cd26f9f546138ff080d00166f
SHA512c3447e913decb40760ab72ade78fc2d0cabf0e15566dc8e1f93c570432f176232e680a94af2bacaa7f8b9ad773ec0f09908ccb7e2231d09bc88e31472af78925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f88e52ef05106178794abdd9d8464065
SHA1c33dcaef881c007917a6fb225e3a17157be546e0
SHA25639ba97094f26e2427a066d9f5aaaaf4254d514c5d2cab749667253d42a314c09
SHA5124891eda34894ba1ec7a61be5b168a95353e6d17a10efdc529710fa60bda9ec6828f542ca607ad935b1d834efea5adb43327c7238c960d07a06dfb281256ef77b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d2f75249db829efb1f3e09f53de8bfb
SHA1535287da5f47e4a36c8efb57f6b5b7d5a4a3a214
SHA25639b02c7c5194709436fd8b708c8ebb6ac30fb86a843e81df842d7f48c29f77a3
SHA5126006e0b7fef042eebe8f526ca9e82ab988a8de839a301e385ae069de9b3fe19b30b2c0b4d0c9de7d28c024603604df46d9d6715b483614461311a015130ee3d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b2552b1d0a0c8b052161e5cc1a1d908
SHA19aae73246b66dff49979b30fc9df43fc690df58f
SHA2565c6d864f33b3ebc430c991fdba02bb6e48f433dae3c09cf36fa593ae4e345a92
SHA5129ad1bf024aea8da47eb2e169f18f26ee7da2522167e4a68ed88c9e49976c12608a64bf82f86d62c50e91255331415fff9d43fd93bcef7f362e7fbfede8c4fc9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7175198647d0831cd0791a7cfc56bb6
SHA1687245b2e7e4df232cdeeb721333720d290127db
SHA256d057009de63e38df458790f587d9c4c6d98f21eb691d839a4aac755cc4dd89a4
SHA51216665a2e6d13dd0324bf9b52b382023450a9a8f82dda52b7acab58bfd86902c03ca39dd75e562b0b0f56a6a913d73a30b78e4bcbbd08ce44b042f889ba5a9eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e126cbc0eae12d2f13d31abc8a3f2e4f
SHA19d9592acbb1df807e796e766a85d27253fc0b986
SHA2565a6883cb1cd89016eaace2866dd6b443a9ea9bddbb2fd379ceb8e7e36642c27e
SHA512e3ddb099d2cff711bb502080af2e5e4517e1d7b96e7b7f5a70c22bcfbab5f6d239fc60c8f835f60537f76049247c8e758567bcb4046f1f8ffc8ccb78f2dee9a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5743ae3c04a7987f73081caf85d740b56
SHA15ec6dc28b6292eeac7c083676f3bff63c6327d29
SHA256984bfe3fce2259813ce6b8ab8056d142de241190a3822c01a0ddd9c6c852aae8
SHA512d306123c8d96e26985f4d98084aa55267dbe5c07c2a21c86fe68e61c0492ca31b990ca751e1d69bf418e8ae5983fd3bc1a40d0d3d0c8bc4d7aa6f79ece201cdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf38ba12ecffe2284c71549c2e15ba98
SHA14c4c158046b9dcc76ca46aa3644ed4807b19b4de
SHA256fe133163c86668025ac4e23499ef830a8849a745aedc434891b1e9a1fe4226f6
SHA51223f22ad9e7f959b93a38b55b3de73b423cb5fc14a5fed12591a31b7e93a562b64b69871ccb322f2bf190092a366b6e59108cbabfcd99e5c6587b1abdeb60ae0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5317e61df3704bd1c659fd2935c5f7598
SHA160d3ffbb475d6c57d02cddfc4ca7dfba4934cab6
SHA256e406b5cc4c2829ccc7320e6be4f4c040d41b236463a8d9c64ad7b98d38eab90a
SHA5121ef9bac0766b0173b386db9e87a632fbfa8565c250847d3488bea3014100b05215e2cf6686be21e810220c9a6e2e63db66dc6153ee46b78b1a1a689c3e8b9a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f165d1313c3bf6291b3e621a81abdd21
SHA1dd364819a380b2ef9fdcbf2cbd2ae82297d6adb3
SHA256767de4ecbafc6079b391e4a9e5fef34b1b07473ca5b52ca10ab6381a139ac9f5
SHA512e56884127b189b888455bf152da6d6b0f970b410a7da88187f6a246a3306dbebf42e966cece643e32e50c8e987ba7f56bcb0de5a16a7dcf160a4ee805d283250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5306f443ecf064c1080dcb7ab8db16353
SHA1b9e6d4bcb0332de291e28f3934614412bbd2c3bf
SHA25677f811631ddb6c58d941c4c0c64360e584bff2dffbbb65d0c3d2fd4fe339bf76
SHA51209399b82cad4b173648128be41777e411611e18bcfe480fb6c3f325be92b0bd3b7f3ae3a1448d9b8a94b5fc6950ebb1fdbe52fe2f8810c6e391396902fbba751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a42a17c50feaed8301ffa571a6a6d87
SHA12fd515fce64fa05c4138374cab35e2a867e59419
SHA256ca3dfd36da46c20caabbf2e9215da6a275bbf13da03eb9cf8dca4cfc610f6c2e
SHA51283d1165461daab2d0a938c89cc04ebbb33189afb1bdb979ce4df6b333fe688eca42fb668a40f09dc7fe02d8622057e8f5f13ba528dfa69831d7e8ccd7525302b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5843296291b85ec2cf55c2da8fc6ee5ce
SHA13bcf17f16424ec5317907c4b5c8ff68ae4125bd4
SHA2561611f02a77a36e8dcd3fc65abb077f40da701f61ae7a2bc1d7cee89c70a4e013
SHA512d346aa926fd92da2373d50e4badeef2cac9d50c74c5c5fb37ff6b05c159e0fe2e75bfe324154fd2b69e212227d72a39e5dc8a1d11965c2bf046107b2ef1847b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f1ffeac4df767d06fd3b5950acd91f9
SHA1f9e19b5d0d0c8f81b1a265cebaa4ba05e166b210
SHA256bc49788b3b4080ba6447afa4d19129017584996264c0e87ad97f218c1be5d062
SHA512fbf9c78c65e4873b3b6229c0ca84719092985fc46de92e44f24b1b9be8accc91094225833ac4e93db54a863f2286face7a765e05f3948d837176f9ffdc46bed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4226254329714b63936f86c30357b0c
SHA1461bf5963788b70713ed11483a31b4ca25094a4f
SHA2566c808b410197de40f7472502658de451e2e97167358a34c191649f09945b42e9
SHA5127e1b5ce93e15a4870ee5397aee9281b3256a5b75af038367f64a9f44494d0a2b2b76352efd6418cd4a597c07948fc3bfe7448c9e4d723cf183fe88ce6ef76512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9e86084a3280bfe8ea5fedaae7053cb
SHA18ae17f8316ebfe1c9b5d6e3a52e3346824703da6
SHA256fd8854c4ff283ae5107ba3ef3d798c9c1e2a4a41c5a2732acab0035e0fad0bd7
SHA51261ef134a158e87b9049ad6c509896d30aa359c19d1e6aebbff62b008705c0e5bbfe30c5ff74c66ed93488039e9c14c6fcde14358698ed94f2f57028d53573eff
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a