Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
7497950356afdf1fae4a6510e0beed70_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7497950356afdf1fae4a6510e0beed70_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7497950356afdf1fae4a6510e0beed70_JaffaCakes118.html
-
Size
11KB
-
MD5
7497950356afdf1fae4a6510e0beed70
-
SHA1
96e748050e41e08a8c52ab3223407ebe3c0c2dbe
-
SHA256
105d2b15577865a563e91f524e83b929a8e9c41cf3681c7ad1b294b40388f73d
-
SHA512
c9eec517f24374c3a6e50e9beb189918d6d1ba1d92799afb755b5041e1b4bff6a2239ab8e7ae154104ee89cf119f3fb11030a837da171535162fde615757cd22
-
SSDEEP
192:SsRd2+i9RI6ciZdZ0ppQDX4JPCBRGnVAUDrilw06z3wx9+ZT2:SsRU+i/I6jZ0ppQDoJPCUnVrrilw7z3a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422866641" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d91f93d5e22ab2a81af05541a1a699a45e5379215a0a0cb5e212231f7c9fc94b000000000e800000000200002000000031f21c2fb9a4ce664f77729035dd6394291550d8b283017f1a505c2ba4c2cee720000000c7d6f7558c3daf52ce3423cc520a6684fd14f2f3a17ae506a676acfaac7d827140000000b6e882579faf13ad3b520836eb95623b6c5d59325d32046892968e05054aece141baa931a13fae570cced58e4736ace03150ebc76bcfe4731350271235867159 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ec287efc4c1c4dddaa659ec3c45e8d4f5f1686202394e872123dd252f22949a1000000000e8000000002000020000000769ab82e95f2d375ebde6d2f990307b2e76f6099b083ce094c2f6c715136c9fd90000000ab7582e84445fbb7333fd49d5202ef194c762c48579ef852ad6465fdafb1c95e23addac8b5502ba15d09cb137e3e11920df0af051adea45733ccf31c71e2bfc8eb209dc841a46d37785539baf74c2ad969e88bb9d434b8012b1d0b33eca2e8cbc71912fa59440a1d5c6973eee62ad2571f5723ee244dc9f809377bd0f2c80957153278a00c874b5c25e887e08a04f2064000000015e20031fdad2debc3df7a20255e53eba43cbb10e6f9bdae7d176f3ebec87230a1efa2ed8d021c0067ebbe42f33e4a7bd804c07280d3946093429bd3bcc85b05 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA134B11-1B28-11EF-928E-6A2211F10352} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200ea3ae35afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2288 2068 iexplore.exe 28 PID 2068 wrote to memory of 2288 2068 iexplore.exe 28 PID 2068 wrote to memory of 2288 2068 iexplore.exe 28 PID 2068 wrote to memory of 2288 2068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7497950356afdf1fae4a6510e0beed70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787f399dd9da76d2cf4566ccc2bd7005
SHA109143ea7f11975e0c3ea03c861fb24e97a27b80a
SHA25613380eccb4e7dfcc7c77f5c769bf454db8f7a0b8950cef05077c83d49e284f9b
SHA5122f48cfd625d1fccb5cd33add75d46d182669d168b6b25a4008132901042972668763e887fa00d8cbc6ef5e8e6378a04db937b8ed897c48dcdad35a9b35418390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549a4649702b7990723ad92d528f6ed39
SHA14c1527b2dcf72e17c140f3988d5157e62b74a6df
SHA2560e59d445f5f0a3ffa6f0524ee4b0711fab90f156c44cde462186b4e8c0d9b112
SHA51233c2794375585af2ccec83eb3a9b1cbc2bdbdf3233604d9b664e0c6dc544a9c4f8219c241ea29d1b2650b1f7b04aa87437e5c07efe7b5d8ee51ec8175f3db19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f02a3608c4f812fac93e1cc5b6bfda7e
SHA18be6bd0424770046d79d2069163de280c5c918d1
SHA256f2699fb6386bcff2885dc44a219e5846ddcb503bb3f3482a2009e254702c25a0
SHA512faca064bdc6db9e68f0792cf2db192adba22dd345a696492cd4c74b7a95981ec3ea1f0aee10bb9dd9cbe0221d6af9641013980fdc53d05b81b62262ffe1baac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7fb6cb57579e82f4a22e228bc574bc2
SHA1d0463c59416d7191fc99e9527d0f857daf610f9a
SHA256eb37ff3aad56e61bb753164c1367027a19841d9173f43d5d065ad7ee44ddc82d
SHA5123340fe90bd15a553107c44858a43f36f0175dbf66aa7dab9ca8401d7c6c708faa87bcca6a5bbeb7cb942cf013c3cfbe7e951d24c14e34bbf3737c0c6a5173f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511aef0a1ce1bb36f45243be86055efda
SHA189877b68267e0f09b8abd13a46ed2199d45faf71
SHA2564e7cbec4828e1b82aa827d03531784875061822f50705265e105ffe86d7fc5be
SHA512cea0dbc3b9ae0065e9af0fe06f2e536ec39dfd303aababf142d76a00d851e8dd3e60a1db6a97ab1ae707f7f764fd64bcab02d0f92731d0aa9c5207a79c58b91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506944c13eea003af83ca507017051fc9
SHA18047c3b5ac5499c25a15773d57861613e6019287
SHA25678aa55b8fcb305e8454d38dd8bb01d9207e8f8ab7341682d3e4311b4077594f7
SHA5123aa24bcaa94c64712a18b192cb881dd180f1d0430e3b215fe0f61742911a817cf36a138c5fc8d7774b3de4b98c9138d4366b0163ed82d308e2dae6b864b1b3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea817b244b1293fc756038d4e7c4497
SHA1fdf158d468b86d36aeac2eac59b8f9eb0ed96e53
SHA256164f98ebeb35da1f9115a9780007ccbb36fc863df6eebe54cf68a4b1b1a2adc4
SHA512252f7423ac3e1e3ab5bcc53922a3ba7c1c1d218615175456afc8f6353ba85c6c61dfbcf820762337504ceccb6c747474902c2607632adfd233e0288fc3305a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f7d4a925114875806265a7a8d7d66e4
SHA1dcc980f1741a06540acef75c998fbde0114e5065
SHA256a7ecb4621f90c72f34983bcddc61f6e780d0d5c5df63a0160cef7408f8c8728f
SHA512c2a14683357d6bc52700039558fbdb98b57cbde031c0fddb49438858ce5f46eccd77a671fbb69bb92d114e4e21a565494f048fdbb7493c69b4679429ede2df94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569230211eed522c26a75830bcf784bdb
SHA15ef3dc99e9d01c557a4012e88759d260e6d4687b
SHA256d9918c2de0b34309628fccfaaf1436e8da68f7e3717ae65be35eafb3885f1064
SHA51217dae7c9c30236ce58a9be0152cfe00270380baa4723e55515baf97171e70db630af8d7ca7a967a84fda626ea9bf29dd84b8e54a9b5829c618f72f19adc42ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b8aaad62b8077ef16ba579e22b9d2b9
SHA1cdaace6409fb9e53f6e9f302326ca7f42bd0bfd8
SHA256314e15d02219b9d9f7c9ee69afa486108da18b67873045eebbc6ae8ae5d6b0e9
SHA512bdff1eef499d774e1a65b8445c85317ba3cc6d32e585d959a1ac56ec6407a37ca72e166e82ebdcd327d8fb7af3ad2466d94de80335e68d8528d6d57e5552cff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e53647cfaef6427f1dc34a72941acef
SHA1a2529d467ee175a934a8c8c459648487d3eff415
SHA256fd6a14cdeed5608231e157652e0328cb18cd8bd6b92db29613469db885443065
SHA512f83691019305ff74bdf37f3d1fe3d9fbe70853a79c947d36c82dd2f6e927cee628051745d146860c850448ad9334787a4899ed3ab813b273dd5328c0a6f0634a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5043ea50b7a1254341131d3e9d86c818a
SHA17d02b39acd445da3e928f85acf671d4e08729690
SHA25643d3618290b517f0b520adc0d8bc6c83776d3d678f773b5f33bff2ced1c690a1
SHA512a91e6546033b346c22f025e60de218abf8cab175c9fc11ad5398f9cbb3df9e396d91950ba8b5d2c7d3cf4e6ad9a37932513285ac268c71ee3d3440ef91a4b427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59720cd5c58fd416a049d3b990fb07e2a
SHA1b969569c223f9e48f6611e990c225c5ade52b1a4
SHA256751e81de53412dfd4db2c6da3d1d60bb54cc402e4205fe874895923640092816
SHA512ceca64cc667d45a834a10c32cc6709b121c470bc59c00f16529ebfd9c7561248e5406676d93af1b5eb25fbe7903344518731aaf53c63dd9d2ef782741cc3fca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c36d058f0084342e789fa2bb9edd9f
SHA132715aa5b6e1d4e47b4d71f265b3e54c254a361e
SHA256e644920285a459a378a2531d311eede77310b29709bfd371d9267542c0243d69
SHA51241d8430738b036265bfae70675fdffd8796b6988fe089d6786225fd16e79fae301364eb9824cd3ed0650f05f4524e040a934a1e7bc61fd07b9d3d42f03352c00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e7e0e35abd24f5bef9a83eccf5667f
SHA1f3cde28bb4ec21c1e5f01cefe67086518accae08
SHA256a7e9b28ff3dac33010ef1d339eda0a3117f22b6241ff1a61dc7c20abfdca0812
SHA512b20c63c0e7ae5bd88b0981922345bf53872a1841ac77247eff78519b354052409ae1c2df4419fbbb018cb403ffb6ceca57e4434342d5c8d0b1a889a5f6695d0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556f4f2d8b81084a00164262163b67156
SHA1ab9cf3935b154e969eff411de7980a6564701d9b
SHA256194ed431e662c56944818677137b9e6d27d134ed38f899ec0f14d3e9af41c5f0
SHA5122ae55ae1dedf166b1b76aeb26adbc214eff981c0d254539a2b397fb27b6c945c5de19936b0d49e21cd1691610fadb2a5c33144b749d60d0038dcbd35872c138b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536fe670a5d9c55e2f84c9cb4bf47338a
SHA16b4978e311b9e4768dd86f15f946bd75e459e976
SHA256661a57c78da78a3f535f5be53706aa94413e5409649e018ea6f62db1a71fb959
SHA5121912d482cc452986eacb5b4456e4c050f242e018ba3a7fa9967a7cb948a957a1fd72479e21d1cc3bf489119eee6053624738d234fb76130c7c8849448cfc8469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543322147d240a8f8cab6f87e6a9fb3ac
SHA191a66c7e035508f7cc863fdc97cd5eb7b818f5e7
SHA256111a1839f38038c68265c7cde514d2889d61fb8d7f9175bde335ab97cbc2f45d
SHA5120bcfb7ed00717085a565a49f74013ecf18caf40e099fbf21827ea2c9fc13028ad680d114b4f0041e535314d6efdaed8eeb137823ac49067c6263b4a7acd993cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589fe4f891d990f00b1f3123ad7a70b10
SHA14b81cd0bce2a2652b9a1e968f7136b86832ab4d3
SHA256d1c0c6244d53404e62de4f8c084f37c372aef4ee735b46276f87967cc23c0740
SHA51236b920ca4cfdfef5b1c8796d4de6d333f2919f4b2048d0ce32dd33cc42cfa3ab5bd68a742a36a36e39d89bbc72bdf6f640627ad1400a3708ac4ea35fd40fe643
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a