Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 03:36
Static task
static1
Behavioral task
behavioral1
Sample
7b8fecbdff477bc0d8e3f67252024318_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7b8fecbdff477bc0d8e3f67252024318_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7b8fecbdff477bc0d8e3f67252024318_JaffaCakes118.html
-
Size
33KB
-
MD5
7b8fecbdff477bc0d8e3f67252024318
-
SHA1
935ae0046d3f8de1563ee91267ca7e5cd4d032ee
-
SHA256
11f5089a7b180cecd43af26cfb237131ba36414bc07ca2b62ff63ec028e5722d
-
SHA512
d97d4ead4b9848fecb5ac352a1ee1c74f4cfdeef53a07f601407cc12d253a073a7b070ae43829d110db0b2747b91873e854c71a3a95dc51c1ce7f20149fc9bee
-
SSDEEP
384:Of7tDLJU0/e2YOo6wb7dqw3uR2M8v1J4Tb5bgZjI1No+G3HI:OE02ftHI/drNoNXI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423029285" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000794a8a3acd0b260dca08f43d96e5b88dff726139d670bfc7272e7327623b9734000000000e80000000020000200000001ddb11875790b1dde1d7b89df82d5ea168dafb826bfa3cd17274f995ac786b9590000000fd1bc0d3be9ff46654b5756fc100bb3413e85a2815b566b1c3709c89f1b6075caeeb55515128e810168d943175ca8986cf3da1bcfe631dd5aec0e9abba8c23107402638e81a053dfb84c3abd992df17e287dedcf7ae7b83cf662a58a99ef18f593b944156e833c8a3c8c59b9164b91e7088cab7d374ee300f82249548d29fd3ab18bbf13ad0a7c07cd9236a76e010a554000000018f0760b2960c08568d95006d669357cdd3a04ea0f342f7dd7f97e739ff32caf16888462f89071566416e5279f103385b3a583df982b42ac271bb3bcc2332563 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88E0DE21-1CA3-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000009dbda997dcfab1eec061066a7221d2e8f2a5e68fa4dd9f1f72b759c860501aa000000000e8000000002000020000000d213ceae0625ca46cc88990de9f80cecea7c20ea513490ff4e2d137423c8114b200000000306e24b16bbeb1ead0931addf30c5c9ab77fa7858642da949fa7b15a17a6f8540000000beb4dccb5fcc42efea592ee2b3d90812168c5fea624f48ad9b003993a5783c0dd5327f431b0a0a0ca25407716c6757b6e5ccc4b37c72f91328860ad256f2298f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807ffd79b0b0da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2144 3000 iexplore.exe 28 PID 3000 wrote to memory of 2144 3000 iexplore.exe 28 PID 3000 wrote to memory of 2144 3000 iexplore.exe 28 PID 3000 wrote to memory of 2144 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b8fecbdff477bc0d8e3f67252024318_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a29b29deca7520868b05f1f20e3c868
SHA1b93f3c863579ae445b02faa394068b544c5141ff
SHA25615170f1acb7ef71f47ecf2e2ddde6fee41a8bcb72524698629e1d1bc8aa8f568
SHA512c68e2cb45cb259d66f93d60158713f6a35c63fb8957e4f6b48a53eb997bc6764ce057e9e6d07e48bd6d32435ffa2098bfdf062ecb8b613729cb7a761c4f43e1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52090dadfaa8fb71a34b0734cc33d2a51
SHA1d898d72b8ca6527ed89175b9e46191ad4c9d67f9
SHA256b75dacdcbadd617cb173b54b0bcf4515483b04a6c6e3fdbb007c59a17b1dbe82
SHA5129377635059ad12ba5834884de7e579870f46407aa6ad9024c698b9b307bf95c203bc1668817c7a797a78859d07912f1efa45be0cc5f44de8b0af5b7be4db4fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595bfcd0873c556c8792c4728ac9c449a
SHA1caf797717a4c6734b938f061ee0ee642d52193fe
SHA25683f900e0d50c2d5e4ba2c767afa4f3d30ca34e0e736b28a1c3acf8de2f381920
SHA5129a0b9f665dfb4cf252e7d716666324cc46cc04e8fed4a5d13d435510b017113d5c71193e95b4fcb8b411b8295cc7be24ddf90a312ed7bd23fab276c60fd198fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58438c4924485bbdb2194843dfbdcdb55
SHA199203827cb5f03f2ecba714fcbe7de8fa54fd845
SHA256651625e8128f765cfa45582d9fc1a042c79bb5111d7e28ed79d5324db9ce897a
SHA5123ead234cba22fb5059ad86797999db7a955cfe21c56d5e73205bdc7939b1ffa150475ecf40a572eef6688b833b67f3360d7bef6d59a58bb2b306368239d1a1ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523da73efe0ed0c0c7d272708927b6b95
SHA171599baa84422bf23102e1ac44cdd283e9fa0a7c
SHA25676e0c9ef6bac5f0084ad8ea8bcab23ce4b981cf93cfde0b5527e7be096c91595
SHA51289ba2bf916d71056a36a0bda29769fd4142d091633130a8b9e6b6f1716f25691d07bca0faa01d430ec333a6f53431eb073338521a39d1e62243c31413bffa054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53836bc4cac7968f89dde95c9dcb48e06
SHA1df02d3825715ba2ee5bcbfe6634f92b2c59825ed
SHA256a9307a81b2189e928b805437d2adfcf5bd80adf15ddebab10e96e5936f2507e3
SHA5123a94dc321e76d463eb4163624388e749b04549354df4d45bef382f37b703d752d71562f54a5e0b5cc7366fcaf599a2aa6bb299b6e1ea8280fa6223bb76238f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5606588bbb55bc67f7b161ec1bbb97414
SHA186cfeb9b703904acf00c5d5c82bf25d8376382de
SHA256bdcd963f8759990393716354fe73577dd105c0436da1c58ce2e05fc7e1ac27a6
SHA5125902d1893a138868c209f2efd8aa9d814f053da893e6ac1bb546f9f86fc66abc32368b281bd53c3006d981d4a8eca7d6774c52051d5c556d6f90f73620ae626f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2608b8134d6c7c86829c9fedf38d056
SHA1c3a43500125c317253601515db011182e52bde1f
SHA256b6e6598fe55681326e674f15f8bfffa72135d011e2fe19120877562ed7ba7a6e
SHA51283029bb9748bf9e5c0bda4bdf161592c354c815d6cffe2e12b073d0486eb8e80ab16ba3d85c89f2a3e609815f5f00e657c0b8fc157c6970c91ab1a49351c3f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef216b4c7d69c92458f32bc1d905c34c
SHA1dcf2b590369b98ad083c6b8697fad7c135065789
SHA25681181003d7b715a9e7c80dc35b396b232c7c5d4d477f15f7a1b6a552c3e3c07d
SHA512897751e0379ef2d0974a7c84e7ed65e9c465bdce0034d4d18403e59a4e4a7c96b0af08420cdf7abfbfc6b73ccf44846ea8c6124988d35378f4cd638badd26f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a95ec882183f17dd208d311e8a67844
SHA1d7b32c2a5434cc88421384cd3effc796cbe964f7
SHA25678f868d6b657a406acb0b7f49f8453e1d763d55187f2dcee2c77cc423770d76e
SHA512aa1e0e4c277e75b0d80281cb518a6bbac924b513b674b34cd63fe2b3769eb8338193d393a52b68ab12698a659b86f733639f2a3f03fe18d8298eb79e6fe2966a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54feb181ce14e2ce315bb5ba641214347
SHA1963d0a02d057ac4722f63e74728efe2a5702c617
SHA256b70ac76ef4b7dda889dae0f83cfba72762c1c55f72c2be4d6853c716c3a2b6cb
SHA5128d5e50d2f52591ea93cc2b1e9c73c3e8bd726f153184c7ca33c850bc01157cb74cd7a500f68952411bf10a960888497f3dd854cd69163e7001010bd7edc5e58c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80fa31ab8c3c8c9ddc2453917b8e73e
SHA15171d13ed69b8c1e468f504402118e0bb38920a1
SHA2566b5dda8bade76a1bcf17c7bbfdee68cf09f76506ef06edfbc3f235a0c0d9bd63
SHA512fe56027dae5a1fd96d83ffa732ab4734330e57fee16aa458f156585fa965ce935a25daf4c5135ca4dce92543435472bce351fd910ef185c5e29704125f0ca80d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2864c655433bb3a19d3801556de63e7
SHA15f04c72d81822deb79de2a34d5f522c72397e805
SHA25643aa051363ee65193ec9d781a2585ba3a880bad8daf307104f8e4bbcb66ae201
SHA512475b607cbf4c08bb6f2c8542c61df2b25d1972dd9683471415cfa95f8ce5fda96663f4846957d9894acccbd594cad763ed750479b0d919aaa6b7ffa08f87b719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566d13885265e7f8d97625f15af70f092
SHA1aaa23841267e11de25914ad0ce0bebfaf1187910
SHA2568cf11d336fcc76236473e19c3d74deb36c0714ddde0f4f641ba0ca3dfab283de
SHA51204703d4eb3bbb923a818ef68d9617bcba2d393011d781ecc9b2cc47c31180c4263deef3ef849c9f6f9c720ce734632206470bb3849a12b89601a118838008869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530748ec5e627bab4021d81085d0ea361
SHA169cb3bb49172e656b7b8cb82231c219fa1f9495e
SHA256de65fc894b958bfb640c9080d96f3facc91b365ef8bbf32b2f8126b608ec668b
SHA512d2e779d5be0e13053d46d93c816dddc54b2632377755b56f5bfab1dd7718e408666a9c381a699b5ad4c848fd791257e4633eca3ed8c13616b9c87bfb52b41f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545734868a32e906ad47ab52298bc46a6
SHA10273186a8abe0bf6ae3630e24c0381b07424e6d6
SHA25659a0044ce62a2c9189b2dfcc8f709259e2ea625475e953f4b7a643eb7c92e89d
SHA512a5510ec3f6c686c958708c3016de396beebee9b43dc9ad753defb6a99e54ae8ec938efd21915e053b73f81ced78fe04b4f9e1e724b61419fead26486ee9b0c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53db5018596ce7bc948c03951359b4d31
SHA192c2e97b7ff4bcd6cb88733377014323c01ad9cf
SHA25626bae32c6332fb744cd8106742d9e7c23411fd19fbb19182fa71ec2e19901539
SHA512931b9f0bd8454a791fe56d92f3c35bf8bb442296f37ebb23d10875b97d4a81ec687254fac9d1f50c065af4a243c9034b38fac81300ee2ebb993b2a38eb44fca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581bdfb5c5b30341862afba8031d5e23f
SHA182595a029d75cd354ba68eb8119539c884d0e6e0
SHA25679482c4f6c1ec3eca2d6e834dcc839afd77a40bfb26a3a96a931819a915c4875
SHA512e5b97ce09730319447f6f071757e684b3fc4902084292e49bf1d78fd5447b7981a54268fe2d26422de7db9a08751bd9058cfbd7ec8e1ba53f04383a789072ca2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a