Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
769f9d9ec38fc342eb5f1930b6f69ac1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
769f9d9ec38fc342eb5f1930b6f69ac1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
769f9d9ec38fc342eb5f1930b6f69ac1_JaffaCakes118.html
-
Size
19KB
-
MD5
769f9d9ec38fc342eb5f1930b6f69ac1
-
SHA1
5aabb1cbc7b73f23e345259221a9e4b86c929b15
-
SHA256
4eaa3dbe1735948e6606ee9184121be527ba2d2823dd41223155fd0f58cf079b
-
SHA512
44332db8a20f4b51796a8a48eb5360dc004a1d5a23dd0c16f2e232c9ec0c2f0c70b0c9c42de3c6c114288c2512d965bc99a0a53accd4e64acffe9d9b91616e1f
-
SSDEEP
384:ziVKhgESDVBD8cyQ3RSpnemLEXucfIk9xheDzVc9I5:ziWSDgcV30cmFOIk9efqI5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{049F3681-1B99-11EF-B937-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000781b21adf37f1d43b6e9127754470f57000000000200000000001066000000010000200000006f9cedc3a47afa35aecbcb72bf8df20cbe9f04f0d3af94a205afbb8ffff50d07000000000e8000000002000020000000175cd01b58e8ec865e442c535b533c90113072d99db4595a3f1c7fe81f4a2a779000000011f427b7ff2d110b134c410b8e8a284464ee8caa51175d02a13ca81f399041cd310dfd817f9a99cf3f2462c6311c2f5769b9d13831144c87202c10dc90f240c6472cc9404e518885cfa8bcd8b78986e6708ebebe988c83bfd1c754501f16121fdd534a6e9428de5645699d22c9a9e18d05904556c2603148e333c6ce4bd84695de9d63a47bd362877f3aae9c51f1646240000000778048bd6ac905f38eb3ba2f3836e9f27de44db66b988241e2ee62fb248720a1c424cc900230679fd2c4c9b7754c5edc98e63537f98401fd5622741dec8af801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422914818" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000781b21adf37f1d43b6e9127754470f57000000000200000000001066000000010000200000007347b46027ce60e8eca4469284abbfef721c569a25465fe60e4aeeeec5825ed4000000000e8000000002000020000000a69d011a887d32e1193a199fbbea2426b541ae776ba841c41d73efee817be1882000000022aa02bf9c1a1e575711e6900393a4337a066112504a2221c63b98f1baac934140000000f759025df3444256df2be5421d93cc29c98e46f157ff1a512a07b187a35f7b74d01dd03a7d8096933cda6e972488ac3f2bf1e442ca6eabf57d07c61d15caa4cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003952d9a5afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2944 1720 iexplore.exe 28 PID 1720 wrote to memory of 2944 1720 iexplore.exe 28 PID 1720 wrote to memory of 2944 1720 iexplore.exe 28 PID 1720 wrote to memory of 2944 1720 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\769f9d9ec38fc342eb5f1930b6f69ac1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5725cfce99fc6cc3ccc7f40c851bcc99a
SHA1dfa240aed0695dab0719fb6775962d4f7eb12487
SHA25691196cf33a5f7a332b27d9aa4df74d3a1745ac4b83449fd959404f4671c62b23
SHA51266f53d4c685ee5abaa94bf30fbce273889e929fc13b45360bc2c8753aed8938a8be082967fcbcb7875d74f6b52a6608488db4ff7cd764b52b57155e50710fe8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d0ccb7a0fa35e04dea14e5f7b42fb96
SHA11e15db41164eb5832c135298167e3b49b2363fe5
SHA2569742d1b9fb375c406961d6a21e0027ce0b6d0865291b7f0c29d9d27004240a35
SHA5124fba35fa7cf156d38456db4d173930b811eda1c3ea9dddf34f5b9fec91cd9518c9f33379609dc479721387001878519c74e96a4892155c9b9155c89196f1f99e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510608d0553263eb144cc75bba6efed49
SHA16b5447b99c5e9e0a188bdef5bace1574ba02fd23
SHA2564ed183e456f403e05375eea3d0cafb32176fb31c5ecdb486fad61c953f0ce8eb
SHA51245c64e156360c5c0e0ddfa7d2129234a9f1b9771b78bce17d4c8082cf6880a84c0a4983053db37f0efdd2149b299d087e8e26c4d24fc3cc488fc56e4de7d71e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bb689c96d2acca3de56edb50f02bcd2
SHA1bc1c1f161129945bb0a603201a03ad128020acad
SHA256d224cad9b41d48bc4fecd04357fbf9583e60063152dacfd0710e55852debba07
SHA5121c9774b506b04186ce617f31215615543ccfbb4f4df2948d0446c28e6aea765a047d6e4e9696d559262f54c5e5d0eaba2e63785e4542e5676f88aa28e89352bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eb7c1877bda03d3087a2fa448f2cfd2
SHA18ee2d5c3333cd72946cfb3f6fdfe8c69a26306e0
SHA25642e5319f94c276eeb93b414b10835c4b06c4188f41b04b74ab64a4f8626b6a26
SHA512646f37a44cfdb924acc0fd3e9d6d3b64622394f0e3700e2f81058280b27479e094716d1cb9fe5be5ca9c2a7d0f515df5e0f61932afd72d03b288faf1a98322b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527391c627fb3bc035b082d75e4ceec45
SHA1287770a1e7f061251ebc582e9c1960b2c4f8858d
SHA256db25d0c89bf3246d6ecc9c7c16aa733b06663d05b2bdd9b3ffe02c2f3c6be944
SHA51246e27728dcc4bd21e4ace730dd80ec0b43a4dc187877ed8ac9b005a1736db563613e7b77b8ec2b1cd63a63e031ad34d22d432ca4e0c34c43ba44b464cc600f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55358680efd23886b6a9118b71bf5410e
SHA10b85087dfff01fb87969cb3f622edff5b5e9481c
SHA25623f7e16c5e90eefd6c37929c92ed84b46908a42979b4b567afc816b30f043f94
SHA51261f984965c2c9f71046db4f417d6bc744e3e221dea34314cbe912df439484b9ae76cd70944c0eb651d2e3f6b51a0c3c54bee3c542ba65b4469c320fd2eabfe8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58df84395089680edb1c728c3357acbff
SHA1176849dec303bcf9344adca7fd24b019835ab85c
SHA2564c5444f1c846eef828f691cf3c48acfc6a655e4b0796bb76f65e88957dbc5d1f
SHA512d174404dff63a1df788e2ed09053cf7218f2f89e4bd962a6a42cb8e088c2f7f55fdb62c241a54dcf1de81add5f8fb1d283284dc08f1c68e39e838083f37416b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a653829b5d9042944e6f5e57f265e41a
SHA1a28646c9c29dfa6563c89ea60b1b1fb9f363114a
SHA2569cd59fae14f8e4c1d2563dfc926ed301c838bd5c0510df6c246f54e635ce885e
SHA512b2947824dfc46534589ceba348ba4c5dbde9c6c2fff9ebaf6b9bcf70b4af587aaea76162b499423dbb96e365d9dc78ced4b7e0cc8ec6085a5172296bb761f79d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f78a1c97c52444046aa4ccf025efcaa2
SHA18cc79813c1ed6fcbff52f9eefc3675089a5f2eed
SHA256b3196b2fbbfe98106569d0cea771b85f19aa3ac95e254cd4dc7c1627e578897c
SHA5124fef1c03329bd9e466acd5a422fabbb0de817ad76af6c7e4f74ecf8e6496b02f8d8be00ebc7f86b10bcdfa1d7b66ac4249abbb5b0c64a39f085c35edd3339361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b391d252a789b88a2dc82dbaecedb907
SHA16bf4ed89c5efb1eec7446d8a2f225fb9f83f0eb7
SHA2568b3cb58e5fef2e90e973a54fd925778d7cd32ed7a18b0bea12d112e6b45afc6e
SHA5123a7079065e23bc18fd98bac8ac2a481b47c5d9eb35f167d2db2e816cba17cef36fa75bd2cb01320c2806e5967679239f821711ff23ab367c13fad35c04c41f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590589bb2de50757f15eef13d8f4668d8
SHA11f733ebc93464f2530542d97e88fd9caee531dfe
SHA256d1d984f5be29e050f7942fc04632839bbacd4d0c1abe0fa8a19e0d020a39ff6f
SHA512f4d71a133bcffd48abd2778b8bc1c55bd18c41e476539d2c897dd7fec8ff23e2e3d2c35d8e9908c88e5b2887a2e5d3472d19092e50bc75f7afcd51b24342564b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5368392190548a369eef499e990236e5b
SHA162e839422217e3a060e2703859f3a8c565253d52
SHA25637f9be769b5dac37a0f848d1d02e025d4810b8e651d2df8ca4ea6c5239c04d20
SHA5124b73c2482b9d6b7e114ebc0e2c55e546a3ab287ae7a4c494d55c6521d220dd0185b1603200f2d377fd3ee7a4934d789d92d6c7d4c7ad3c64a97d970ea61b8d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e4419fb5d11eb76f56e8da3f926efb4
SHA1cf58c0dfed416f1f9a0ebf8889eea2e37dbeabf8
SHA256882fb5f0a1aa9227869c1cec7c2f7d29f330e3978546d48d1486e5bf714a6df4
SHA512600ae98f29513e3835786f2a2f66b7010e0c52e2051e5fdd6c97cf9a46af37287ab05f235ce668af640be7d70273411855e7d3a44b6972867eafa02ff02e8df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0d9700222ea9ef11af4a5310666edd
SHA14aa02411ec7d4210a5de59d66a819a9b47a5bee6
SHA2561194bee1b10af7a13f12a92e421fe41728ff4e898698182871fe4035541bcab6
SHA51289aba5371f3ce856f9288856f99e0d122643c2e613dc4dece84b532022c7c4123d4b565fabdf4ff0b1e5d992a91b3fd007c93bcb22ad91ee3c923c8bc390ee6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ccd57e2da3fc01ab90746417674a501
SHA184c9ac7a9bdde6c04fad5057b063ae410d98f08e
SHA2562afeefbf0ce06e991c94826c0d620a9888f3b5fe8b8bb1b00974e4409d3db486
SHA512756b5a7d4234483e1b1365457058b287ec7517164213f91b2f39663e1130d899c24b4fb6cf86edf32be0e90850d3a5b96c3657c3a9cb9fe8751ac1825f4878a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e472b30960ea0df3a1660bcb1f42f191
SHA1ca15ba1ff6a93451a0bf8df49a7042849cfd2c6c
SHA2561874295b9b0ee2fcdf637944aac857cbb65174981f5e7ce44a74607834a4790c
SHA512ea1cae766a96824a032ab061f0eeeafff37f766a12c4ab509c76b279ff390c3482c7ee9ee79fb88d56e78535c25f2683672ad35acf2a94fe157e9668b9c9a959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58368e3a5f315c426bf22fafe1fe03562
SHA14642797b7bf40ddaff63c6456f66054d3268457b
SHA256aaf90ebc75dbaf374ce4ae378cd5f82f514e59248ad50d4f91c35d9608650427
SHA512bb001e5baac54135f58d11b9250d784fdd6bae4716b488796baaebd485c1c811fda82cbcffc1623622a57319ae3cd9374850e7fec35d6023c56a176b90ab94fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a