Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
6db63ff03065e1557e0618cdbaa36982_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6db63ff03065e1557e0618cdbaa36982_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6db63ff03065e1557e0618cdbaa36982_JaffaCakes118.html
-
Size
461KB
-
MD5
6db63ff03065e1557e0618cdbaa36982
-
SHA1
c7aad92dbef96dfe1118708ff01820dc7d954ea7
-
SHA256
296ccc23a69c51496ce24292461f75096c22b5de0dc152b38146994417d79262
-
SHA512
bc9e2a900174245edc2560fefbfe54a829ee649d7d4bef7a2c733a597381552ef4dadcee557f11843d1cef0560e1d86fd7088986f677b452f4de3af3b759679b
-
SSDEEP
6144:S9sMYod+X3oI+YhQmsMYod+X3oI+YlKsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3b5d+X3k5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004acd096b2634a549ba2b531a5ae2255c00000000020000000000106600000001000020000000da4da3c1a552e4c73bf21bb425d2d21e1c92708c039bcd1d1e95030291ec5e4c000000000e800000000200002000000030c50435dc0ae0fe58a892354043cddbbc6529e9391ff7dc1a804d17bd90d8c5900000000885f9359284f061cee5c35b69a8263b071e1ed1d98e84a6894c14d548875863d192de5748361523f21fea343600fea5e924249bb806d93c3b45599e5e7ce21a9dfc06ecb9cfd2f4d3b37729a5197b26cdca4c13f5de29a4abb3c760a0f1fd9a9424115a8f73c4f1dab6a36df54f2aa22ca36006cffc5262e3c794dbdc0cbba3a12e1adcfcafcbd1a26f4a3d62a29bbd40000000ea423ddb95a0047455397ff1ff5d85e5f8c1e5fd740f099dc5a755e22064a9cb83a4db2111d3fc710052ccff1fc7b31d88f2445457135bb985bf598d490af65f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004acd096b2634a549ba2b531a5ae2255c00000000020000000000106600000001000020000000c5d68160f5271591a7cdcec8bd00ac5b2a7ffd2fd36b35d5a2b057b4d945104a000000000e8000000002000020000000ddb63be06c2ee8c1bc30bb1019d9bf550af5eca7bee348d9890dcdb09d1e29e6200000000e9355578092294df4584c6329a7c0eb332aed21b955e846f6cb87d559e2bd17400000008da4ef704a9f8e86c8bd95096798642f8c682110a5f1ba8c1370f52c388af168a3eae37bcc6171603759285bdacce7ce35218197c4bcc430b6e1712a60b187cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422696753" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C560381-199D-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b1cb26aaadda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6db63ff03065e1557e0618cdbaa36982_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528ebd0a18afbd9befeebf51966dfc9d0
SHA1acebf5091969a08020c58156a19ac51f75bb45e1
SHA256a17276b4e2e1e848155c6184ea2d4bbfbe45b174a3a712fafcdd8ed14fdfcf18
SHA512d41cb728a6ff4357e2b69240b7c5c5956699e2d75be4e952f11e3ed6b4941e8a8f06c9ed30068cc62ed98d4a93782ff9e611d29e50ca782b0d24c36b7d715e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df8d70f796ba90bec14c301424ca7132
SHA149b6ff52493d19e4f5c81548182ad21e1662464f
SHA256617645de676902b791ded2df92040b4d602f4bd3bec332d697d67f7a830eb77c
SHA5121c7656d064861a1c14889afc8f4a987eca95d9b14afbdce79cd22d8d16436369d595a38c00880670066ef1667c7ea7a711f8ef7115ea8ae43164edbfc5fd461a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5434ff822eba8949089111a67a5aeae56
SHA1b97a9d79893b04144a0328d8673778280b271e7b
SHA256cf767afe1b3649df6d0b7fea975d0f9c811d5b6352916ce9c75e96e129e1030d
SHA5129dc54e13d13726bd8be0f16c3549c72422d986880c6307c07741ac8e698deb934ad7d320254bf66c474905ea85fc23fa7a5cd7b0927c0aeb1581545eb954d7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569569908f9b91f0709a63577dcb48e9e
SHA1d22ad960d4ce1ff61cbc7e3518b5adbc726a75db
SHA25697b2a4cb51f2feaae648e74d99cfe5fdd2741afe268c135aba4b43c85f8657d5
SHA512953282d9fd7f2ac5dcfabb3ab54ebcd44591e2b4d4d6db95ad8082bce7a7acabd7f6c6068ddf1402c2d660311ad9da1990d50ded9737656dd8ecdfaaa55fb661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3561ed11fda53b2f90383b3841cf574
SHA19c67f5b1f36e5ed9a9b2191a783836e8623d82c5
SHA256c5df0850ef96f9a0754524ef002d63c21c100adb231e2315204df4e4813ac1b8
SHA512f643ed6fe6055d06d99e19237ae04ac94433a97b1974ed9c5640dae476fad9e7ba002a0b84dd7adb6ec224acf2a5f5cbcbfb07dcb8d3835407e219f904b8da55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e63957f2bf40938caf3e3167b8e2ff6
SHA1c3f4853fc2c3554e4d65e033ebd50d4d33db4c2c
SHA256d102fa0415ded73e224ee74b9738439eb4468f6d9055c7541bc1b34f1725fdd1
SHA5125ca3502cdc625c9c413a2a305fde046e175c1e74a10d7d65a4c45e8ab56de2196334d279bbd6c7162f1bd9008c25ec3c96c1bcb3c18f8a4ec87f04044a42644c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3faa92c2cd766ddf78002900f34e332
SHA1dcd08ac6fab541bbf6be2b66052a14a327e0f47e
SHA256650c2709e7bf0de8eed91d69a425d20848d158ed62cbd374cb2d7d10f17dfdb7
SHA512703c20f8424ba83ed8258fb33f701d73a8ec0e76d457dc244df42bb95676302a468b8acfd9fc6393a1ef95e7280449195c69eb3d9fe247e182082c8861b2cbe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1c2431fcfaa58ede71474eefc5b6f2
SHA1e8316146f383901690f64b74ad0b8ef70508f193
SHA2563d06fad3d3ae5bf604f29c9db4c7a6548b6d9f358320eb58a6ee9cdbbf3b4897
SHA512a7242dad0398062cc0d0e06798b1229b91ff77b9827d9f6aa8517cc6e32aed576b1b8577dce903006ef8fdee4febcbe371498f7fbd6f93a33d8a56463f340302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52defa7afee34dee5950cde217422fe82
SHA15559df8276a2f9ac3697badb15c5d7f985ba6425
SHA256a5acce0bed489c1f7776c824134780ac2cd79c36010b687fb26e7b626e567110
SHA512ea18d124ac77a702d9ea9189834506e6883dacbd3585844930390385aefa67f0f511445b6e96addf38da88b05b772d0328d6c6d92efc74e501d8078b96a4fd6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5302cad00a492997338073a753b610695
SHA175e8de926137e582bd7d260105921b19246dd397
SHA256086d20fb6ec816a9846875261ba90ab7791f240efe2d56b440ab4275444464c8
SHA51209bbca1746020e6bbb00a4f5c2904e40a39df7c9032a28b5a128288e66fe6fb4cb845f0df8b76b93f5159662cb7a15330914c9e84f64a3044d1e47e376eb611e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aab1c1611b391643a04d531edd04b6a6
SHA1ec9b48c4c06d9ab38eb0b3e940f1750b9b2bb878
SHA256e90dede253563e1d256814b94ee3fc9a2430a3903eac45edc1f73001862455b5
SHA5129556c0d1ad7c6d829767027a617928405ab629da6fa93eb07ce5140413d952458042ec7fd2c4595189de8cdb41f0044456ec999ee9af0d5db0fa89d557d4a5ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9630232c23efc467efae72f65dc0725
SHA16d10fc3d583f4f9a03af7df2120fd6cd015cb333
SHA2560b75023352b7857620d637924dd12d4ef883ed0fbc9ecb2990408928c2a0afab
SHA5121f98718237bef9c68536b046fa2fbd140e993c3fda2ab15bf4813453ba04ab666ed5704db20c7c4fb870b579fae401b47c8881fc7b4b8bebde43cf7889a3243f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55390369744248cfe06bd5f6be505b160
SHA1ca7d4504cb34a0b2ebf7ef45d1fa01ad63775338
SHA256b55a5cda9bac88e0d7864a2fa19aef45a3a27336ba9422498309f341e0609fcc
SHA512016949cbc19b2899b3083deddc3ee60893c9809ace50446f308e4d80130f2520979a20c2b7b03d4ce448bc7d9eaade7d812b72ade64164b1d77b4940ac218ca7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3f9068a6e3a481899a706a364eb64c4
SHA108a681eb80a968f63745d3cd45febd46d9d9accf
SHA25648010a7fc8878ce5aa6a7d0f245b7d81d98f563920e053115ad0fbd36a990556
SHA5127714ceaffe00328c51996930f4bdf1730af0503884cbaf70baeab3bfd9a445e5d8a4cdc51c960cb8fe583dd76bdca220e7a302920013d72b7757f13f379dbd31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6304012c4c65e6edeb074715519edd7
SHA159a5fd7e41f0cf4c21e839ba59f47a497aea268a
SHA25694139886c617aeb07717e933b91b6134d4da7233645d2d6a25b9a184a615e58d
SHA5124cbc1ac3b6b1f70562dade4c954ee9327a0abaf9b93363d9058fbb400ed81c0f9021200b7595fd12632dfb3ab23ae1077e4ba7d4467f7ecf6009a86a68881445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8868e9d1e21a235a21e2c61d4b9b15d
SHA1139656f104fc2a146bf111c1090aa58954f09ef0
SHA256b9a689f9a9006b3ce9adda5a4343f2fa6cf4dbe5a8493acccd88c0d0054bb3f8
SHA5120bd2d4317f0a2d70fb9a6ff1edec05206f98273672ef1cc22e329bb6ad8a3105712fe2c2cb327cf1471c7d070b242e7c46f925caafb4a5e39a72098d9d9c9027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7ea0d6a0e4fcbbe9935c3f5c1d9524d
SHA10d1df06319c70d38f3ee68429ed09f509f5b5fbc
SHA2567d63653ede1868eea8d1d18b839d3582ae612a60a8f9e3ceb229655dc4f9f221
SHA5127cf2f517051e12f65fd2727c01f7bce914adb165383c59db4ffa889f2dcf21eaa3e7a9740131f5576eb3c4a1887bed9b67f3036da557ff5ce5b24117509cc32c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d526bf2d4bb9c2db79fa6bc4480ea5
SHA103e458c02f8cfc9208f643802a38d370414abed9
SHA256b729603c2fa5f953d98e7493ac99e4bedb22e041df1eb3f711f87905bd6a5ddb
SHA5120d31e192e3d589a6ac38e3a96cedfc60c2570f175f68362231df1228bf0091892f6d1c5a505a83da5ee853e6666008bbbbebfaf25d46af52adfb8e14255f0181
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a