Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
7119febb4f400c9266486db503a9893c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7119febb4f400c9266486db503a9893c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7119febb4f400c9266486db503a9893c_JaffaCakes118.html
-
Size
376KB
-
MD5
7119febb4f400c9266486db503a9893c
-
SHA1
6c21fb9be776e01c6333a23b4c4b090eccb90b9c
-
SHA256
0e638c22c66cde0b79204139cd4f234d40986109b02cd63d1d4a29a375cd4b8e
-
SHA512
eb074956d3d4d72247526370699ce756572fba9e37e9b356a8e33e9eafaea43fb59c7bc6d594eed890bf2e3092a626fa7f05e754aba1071ba347b824985870c4
-
SSDEEP
6144:S2nsMYod+X3oI+Yl28sMYod+X3oI+YTsMYod+X3oI+YQ:JL5d+X3Gq5d+X3N5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5074c4b76baeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A36770C1-1A5E-11EF-9CBB-52ADCDCA366E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422779794" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000160f5dd08858e742abdbf7d822edfb9c00000000020000000000106600000001000020000000dca3f66cdc01091864da63cf38b7ddbbf7e929cf1d5481ae852b9cf4ae613d03000000000e8000000002000020000000414f0b351ad14ece149e80b48f89f7f071f70870432daec0d736b6740a72db4820000000ff9bae3808cc0585b6d9cf08229ab0299436fb59994ec64214c0461aa6100304400000008c5c073028efca540df7211bab70ada36316ee33fda23c6a88e58081e97e17eebcb57bef922affb5ff1123791e35108787562eef19e859708d1b76bea725e361 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000160f5dd08858e742abdbf7d822edfb9c00000000020000000000106600000001000020000000037778408688dfb17492f0e70a933edbb18d0efb266bd36847f57e9417d4df2e000000000e80000000020000200000002f2b5c4a454f6ab07054b5d90a8b26b39c5258b3493d27b138b93f033398beb290000000ae0d3ecb3734297196880a12bfcf7095380bf9fa597312c7c6a6f8fa9566e7eccf6ab15eb7d89d982a5c85a5185529a4b139d6c3c5a5b5a8e7af5fb4043ea5f52b6d58b43189a917c1abf8711c668fefd336a445da4eac83c477477b6b14226eaf49adf037ff186863c5788cdc4980cf51eb58b18b2f703fd56a7940bdbc1b5a4ac10e940e5a5da26de80b332f92110540000000ec50d1a5a2e9def7cf44cd33757c59f8e59e83fc5843a0df52022d55c4bb6b1a5ade3fe700cde960e942c214b1370dccf09c20f989b1e9c9b72db818812d350d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1308 iexplore.exe 1308 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2916 1308 iexplore.exe 28 PID 1308 wrote to memory of 2916 1308 iexplore.exe 28 PID 1308 wrote to memory of 2916 1308 iexplore.exe 28 PID 1308 wrote to memory of 2916 1308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7119febb4f400c9266486db503a9893c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec9650d469713d454d000267cc96c8a0
SHA1009299dc2b8619ce12ce918a0a995d4ece29e4da
SHA2568c6d2360dd0623c17449f8d361b9a6395b36f7c926edadff205ee847d5dc8fc6
SHA512413f0e7d1411805728b0944837fa7c6e054c18168f1a638c6c7b8b03e4bf6a588bcf96f632f67e7dc95908ec7cd9b4a49250efc0d749d32badcb6f83787fc52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f6e8c7925f9fa94a3299c345402c5aa
SHA1dd94df03f922aac79960646cb6c4bc700bc8455d
SHA2565622e051fe68d66996f92a9bc6e924bfee3db0c88ca29f9ec0748b0a0c8ecaec
SHA5120e158376fdb2722d248e64df1c1e353f3a5adb65c28674fe0594317e14695ee4a622fd73366a7effc9301c03209ca009440136a47c6fb22a805df2647511e752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5618496112ae4fee3447d1357a990c4a9
SHA10a17803b94fe15aa4c9a2da25e8115c85201737d
SHA256f2e3ed0f93753987da7053a72e7a530bbf0a341c7143b7c6c08b30fac7acd114
SHA5121e531028b963c6d64e2fd1d977cea9e4093bc47d59e722cc6740776f4788e9659cf7339a7e1444e258e7a000a0bd2b76e0e350a4698616e94c24992b82f106ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbf16ed4a6ca28fd98cd7d31dc8739de
SHA1a3cb6ae9ad00e1305620f008632e2abf80a37a10
SHA256e74d27ebc7f59bcb6d409f25efcaa6f8ae640168ab32731305b0607ba102fabf
SHA51241525fa2ce71671e95384250ce9d31aa8a73aebef1aa1a5a79f5a5d941cebe99785ead3ac023729c7a1062935d6e5d6d16db7e52fc78bd2acccc48420a310ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519dfdde5034aec00171789315b405d8a
SHA1700d413bd89c7cbf0dc9d6785c7bebcd89be5dbc
SHA25637b18e8cb20c0df1618dc8bdab94b35a8339e87c53314e364196c957dd2bfc1e
SHA5120fdb287629f6a85dd733afb073b5fd081cd5e821029eb797d6ec1deb0afdec1207f452664ceb303b263c76bfa17995ca6654e86c03ee735e1802e60bba191f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be9fe09d2d7ff670cee104835b327d90
SHA100caf6ef3a8b8cb833d8a4584ae0c7ea1ef8c835
SHA2562a131d8ff61507d916acaa288b90571003c4ac437f72f138ae7662bb57a3cb24
SHA51277a9829f634e9720f04e66c2b7827dade7a0f37c40228e133cf7ee598e799278895a97a1bd2e9fc7e39a1ac9b7a43e793b32d53e3e5e2fa8f7a31a66b21b6fce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52726f56e33c50d460e5f0cfb3d841773
SHA1034a6174f7726d59818da7c6cb337930175b667b
SHA256df127d30fb806e6ebe9c2b25155801588bc86060c52a8d6048e5eead8a0a16b9
SHA512edb5718093935c355e1961204be01eb9c924c2aea989300124a274ce786c8319030671c12cdbfaa5e778dc389d813cd47bb91adddb9c62b43fafd49c9a67c8a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af7a2ea2a63a1c94e8a5e51f6d6e6515
SHA18f85a175eb13e265686c4119ad2da5cf0cc1ac61
SHA256f4fbce3c7758cca61221e0ab18baeed6f57750f745759856262cc047150debc7
SHA512ead00fe5136b28191c090e53e8c728a8bd734adae9684fa9d2401c74b98ad85a2793cf3b8ddd962089f4daa8a7b6551e637f7a2473a7e16870ab1ed079dd0308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bc36c59c6e05799fb9bc3cffd1a578c
SHA1a7fdf1d4a26216018a655fe3513af370bc6d7921
SHA256fe566a2cd1ccab1c0087b140eb8af4341b93c265c7b220f99776ec35e4ea83ac
SHA5128c419b6fa627f9427f1ba375d184897b4eae63d231c661dea196cf75bdac959870eb457a0c28a4d26a1f53a2fe6f36c3233dd7ef7af48854b858cfffc74ca0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535cf21a98001f1ace673e0340c9988a5
SHA138533cf9679eec9f38527513e0875338eaff078e
SHA2561fcaaf3809eaf91a47853c1a6254a012927233cb8f00f96c22b6887f5923851c
SHA5120aade1efca21a86ee270c3415cd4f3498ec9377e43dac3c7197f8c714b0a5aa18c65bfda516e8a3db13138b6cea25c4365c7f921f1c47898e4178dab557d3c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ec17bc16a217f149099dc3f3db24a88
SHA14bfd9301040d850b4470ac07beafd48b1d9ff197
SHA2566ec737a1fdbcb7248e62782396f9a786858de700afadd036bf7b697023b7fc2a
SHA51293a08439d89ed2a9f640f4a2190baddb9ac5410d6e9ce86730351b2b10e0000e5a06958726ebebf4cfad959dd654b176a9509903b99345b85e78e99eca0a8973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daed9323e40f227f95e178fba70d1ed2
SHA15c4adea386e7768ba1a931bb9e9ed03d4fc68535
SHA2566676875224623ac77fbe738069dbcef004c3b5cc7aeeeefe3afc9e9938a963bb
SHA5126d779ec41eac32014eb7d2a25ef16e30af5c4916d074a6d694274f4c353b3388d199f6a3a7d8f144522afe0e3300dcadfb2fd7a378cadbae00d10669ca831cf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b895fa9ca7559c243bfa6de2a2459ff2
SHA12b7ebf2f409eca9a135fc4e6d3bebacf5097a297
SHA2563ab6f1c3e341dd8236cd4af3dbe12994a95db342a39f63d56e53db5672de0614
SHA5125ee126ff40bc551ed672320b13871862280960a66f65ed021b56410fd40952b8565e8951b022f247713de52200d48b7b68ce9957b46e35b129b09f8fa1dcdf5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55564c4a15a41a6249467a66d291c5bf1
SHA148974f296b3790c073122c49143884a205b9306c
SHA256964359f86bb24e06d3d684b783843da4fa1fa3f625b70505fb84b1ed15c429d6
SHA512d9e1364566b38c76b2c18e309d8807825505feae411c95a87d05880b91d8a565760d492444e78fe3299263756fc935f3ce9978eeed4f7fc8c4df831a21306bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549f03e935c2d21c618a937a94e9f54d7
SHA19b9aa272724ede5fe56eaba98c6e20912324e2ff
SHA25668cc80a8c66641b0523028238e51081b5ff529160b037a072f33545ce42fc187
SHA51273a30d370f04feb07b30e84cfceed09416800eedd307d6e278f9d56ccd87906e0bd8cdf2776fa3de5a93f1738f5b8e2f67c9a7111b4eb3b885bb0c3e9873950c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5942dd4c1db04d87c02718040ed23ccf9
SHA1a19d2726a9f0aadcdc3bf8be2e67b554ab6c0c89
SHA256cac18b5a68c5c39656d701ac2eb30412620b33fa662a0ab2452e1d7f62218c22
SHA5122fcc8a23a343d65a7bd188200bcaf399325fbf74dcb06988d7d1aed8ac90ae35cfaddecb88ed8f99ce322d80a3a9be576157cbb991e5bb58136453cdef1b24c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f7a3265440bb3410ff809a5ffdbbd8f
SHA16f2c1cdcd56b151fefe8a95fae0422b43d261592
SHA256a2b7b224cf528145a53cdf57c280bc6da6513721e291888a0669918214d2afa7
SHA5124ff39b708d8964332333a0c11d8b187df04e62b09b8eafad5361a2577768e16e9d972a9de0e3e26c62e8f5aed7276be644ea21b1a38eb9181ffc974b53225d13
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a