Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
80709974323e5063cbb78b04a4760829_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80709974323e5063cbb78b04a4760829_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
80709974323e5063cbb78b04a4760829_JaffaCakes118.html
-
Size
2KB
-
MD5
80709974323e5063cbb78b04a4760829
-
SHA1
f88e0fcca3009d42623de8a221aa8858ce1affee
-
SHA256
72df368beaa770fa8365b4de679f09632a4652e10160e6535f10cd84f64d279a
-
SHA512
f5cfdbe7de339ccbec5b8f15f8d6c333c68c4a16b1d287f33c03ebaca663ba8dbc95d8de86acc66b2236c351cbc6c0d0e561929cff60c952c658ea54e22e5d01
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423140663" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b380db531b8100479a8fcf2bdd91873f00000000020000000000106600000001000020000000cdb87f979a5edb858939651d68a3df5be9cc95cb9103ee6864f545c0263c9a84000000000e8000000002000020000000531debd38f23d44b0aec5a32957be117aa35bbd763ed065fa947d4a08701f75e20000000c0c3bebb78cec76b0b9ba0ecb09fb8823cca25f2e759113d33c555a08429e92b40000000b5114ef394000cf31a694ba014aabb3e71b71decd0d51961d3c53536f02557fad91ba20fd8edab22e684b305ec078734bccb6ad4c47d633945f562fa969e00f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b380db531b8100479a8fcf2bdd91873f00000000020000000000106600000001000020000000d4a4c324fc6d9e639113badc7d815a6a038749653182ce327bc1d0d3f4a813ad000000000e80000000020000200000005c65b8d013d6b34b431037abb38f7e6f71b451a8de58e0b895540bebdcf9fac190000000bb81358fe4242c6b2ff7c8854a00dc22fd4d97b14afe20f9b7a899ebeb89ff90597881435c957c6c96ddc6ac9e90ce2e8fc5e4c9c9d0d439c6abf7180261b58883850bef83ce1d14aa7db75ce8fd6421f3a8e7e0f3e519e4dd7101e26fb5d308fbed1ee536d3accafdf5b63356d94bed9fb9595480861a20e1f5f352b4b431b50596b418ab28e1c9fc4c5db66d1097d740000000285421acfd1df7f0f55a9f879a267a6cd6fb9b818d27f26d47be388f112149af0f2e33a18336e1c33166002c0db63df4ceae0d346207a58f74debe8678c39e64 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAD6FD51-1DA6-11EF-A1FB-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002440c8b3b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 iexplore.exe 2492 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2492 wrote to memory of 3016 2492 iexplore.exe 28 PID 2492 wrote to memory of 3016 2492 iexplore.exe 28 PID 2492 wrote to memory of 3016 2492 iexplore.exe 28 PID 2492 wrote to memory of 3016 2492 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80709974323e5063cbb78b04a4760829_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eee11dd43a87d4fb08cacaabc3988372
SHA1f1676e3e13185e91072e25676d5be2b4ffba7c7d
SHA256b04618576f5266ff69de473dbf5d610e107a54847008c31f9337b62ad30e4a56
SHA51289313f0f5567809576dce337962973562aeb88559aaa9ef443341a42d6aa707752d1e3cf85e6cc9688bf4839d94ca65afb56761b1e3695b936aca7ce749ae645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596bb724c4d03650b2ff7548567463429
SHA16ecc1a465882c248b07274f3f3fc3271ea79dbdb
SHA256d065fa4f08bd7e6859d5718084fc51a94453893fff20ffc095cc7523f636f9bd
SHA51215eec0fc7e6b324bd956a5b4eefd769922558135b26ca576fa31023672c9ad0cab1aa7d0bbefc65bd5408cd25430caf88885dbc4ec7e3e01ea57d3f63118a192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5458346bff14283e29d1194636318bf87
SHA1f658c1daf7ea62617af438b3da152d8ebbca7f23
SHA25600eabc28827cd7054f57737d0cab43c945faac09045b4a782847ba8db2ca075d
SHA512afea5e33de5c3c7eaa27ea00b95a0e8d4f09b0f2ecb953a5d0d3b84ab7c2e388d9cff912c0b7b1d877c55b6ed2ddd0f3bbab20ea81cb2b28050d811122a84ddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f607a92891a88aecd9daf00e05a073a2
SHA1b159bf50492b94cbca980c27d320296787aa1fb7
SHA2569fcde3481a4b124b76f587a5024fd5da25fc857dc7070bc1f911b5ec904eb2f6
SHA5121e608ac984cb78a1c0b4736dfb9cc266698bcb188360830b5a816bb5d9dbef8eb2d57c0dfb0d30bd24787e2a155aadf5c5d12a0bd9304a6f0ca10b387e716d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504df6761c2ae7826841c95a3dbcbbdb9
SHA13e51f38dec3931993dba1a72594435c5f46e201f
SHA2565a4c8c94f53716f1faa4f9136ef3cb7808af5633e8205a1e90442248b6734ec4
SHA5128fcc182737886b30e32e3d848c2f245cb921d8fe5677c18f9004a096ef6a971b490a613e521918ef680822754341f7a386fc43b37993b875b2d7e54ade440e0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552279b0cb5942577b9e85618bd0b1948
SHA135ee79f174c61beea132d42931b9943e9689c029
SHA2561157336647faaa41768ffc5f01cd6eff3d135edbe72840b4cfdc95b9027110c9
SHA512155915510b49dccccdeca18c347fead6a6dab45dd612af23bf1b6c3afdc43a8695dad42061a83183fc671abb493b3a72167f6a91a3d9c01b165dfc9b89e0f7fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfadd867d78eed3cd02aae00e7ec5832
SHA12dafbeba42dd7b0ee6b84f8d864966bdd4806cc5
SHA256ada160f7735bcd419fc1faeaec143b7297b2c63f022d13976f2437a7e5f32ecd
SHA512b268f18c3ffc20aaa52a32746bcd2f4ba3459f793e5578da4412161263240ce0a94ad2e7e158085ca60f173c1570ccbcb60069e622fff452755901a3a308a400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f2d5976234391f79af8b13ce790dd75
SHA145b01795527ebd6aedcbfd6a0d8c00ab106d6fbb
SHA25623c9cbf5aa52928be65cd513b3f78a30810eac4df9f4b5fe9bc589c85e5add5d
SHA51260d5eea12e910155665d0dc970c38f92a75b6f417829a5f778353b12ae0a18244c0f636958eea8f449a20b8130c0b0ef10984e99e649e0254198ef2670b6c462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583cc59d474aa9b262dbad38bcbf0aabc
SHA1292bf529a6f7481e05e66fa45dbb8f17e7d4cb56
SHA25619c2b289c04b310e19625b5d1670d06996be2ca68f8e6250baccdbede1aab263
SHA512c4a11767063ab74e47214244aba341a9bff39d7e3a70d02918ff669f90c7e7dbc8ef000eafda60dd7f65319cd3f02a4d903e7e4ac9c4da2320564310d5c29e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc27f4905c2791b7e6ae9573df35bb2e
SHA1c32ee97e505725c69d4cb9a52abfac5be721a95c
SHA25680bb4b0a1c959298d54c3f1a09e342c3489cb8a69f581e3f5eaa743e204188b4
SHA51239e405823b172ce0fcf12af512203173ee968cbc9135bbcbf7239b128dea7e570c1f9a421e6bb44165a095178836ca30845b1569b5523e57d9e2b61fac609e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a828ecdc02bf354e66c1a21a670a429
SHA1d6968e7c3e43fde6459799f6ddc9e1ef6701513b
SHA2565b4c0124eaf284d01b5ee1e4f5f57ce12f94814112a0cf08ed17c4727a4fc056
SHA512c0d3d9f60afedbafd47c64bfe455ace0b282977c9e1696c73a5197d6d43611982a61d2ea9d6af866f894ba62bd37c50cd68645e18df58984a4fe45f6accd8245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581ee60616c1f3e25ce04b1af9b1a35c1
SHA1658fce8857088c59bc57c3f9dabc19ab1cde33d0
SHA25645c182d93adb7f2ab99505a009c3417116812daeaba41f2bf677afe1b23555f8
SHA5126e76610a032a68fb2d1dbf6d7663f4f196313be17812a3a2d6098359b03287f3434d3930480f731f2c183940c79e5ab6f50b24c83230caece6ba1b060668d264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5229d008ae0711a4704b36d81b08e5d8d
SHA15b4d1bf250a10888d150a4bbee21c45bb41e1f46
SHA256946856a08d37e278dd7e8a7c243fe4a3db59f9195dc45e642d573e24d1578df0
SHA51251eec6f57afa31ef7d4e54f586735a1f0eefad67b4aece332e63a02f11a45abfe1b5644b74ab6c900b4f157959f0db75f5549e399316fdc226fdef46b4bfd9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c0694820a2e3a242aff1cac74ab229e
SHA11cc6895afcecd9c11d340f493d8d128e72c3fa1d
SHA256ff175ef55a4004d93d53c4130a0a23fed96c716ae5d2e3c8d8f95f6f99f29910
SHA512317bceb7db3f6224c547e2ff43ed17040f023db25ca9517adf7d32877b7822b4ab13f4285bbc8d01fc26061b54719dc443d4715b9a3542f678fb00db24880c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a721168fcef928e4e53f968b17e5d416
SHA108da20a6aa8047b3415a6190bfefbd6ba8038bd9
SHA256357073169a27a7479226094b9e972bdcf27740b1000dc4ae6e1f76810c802441
SHA5124568fdc22ccbbc155237439c4dfe2e208a316df84eb1011f36fcd30df26a1b2dfb342db5183ea3ffebf4c3f0a0fb409975ddf127268171eb17e61a6b1cdaee3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c001a005eab2dac80e7a37c40b84713
SHA1b219432617e62d7c3667ec104e3d9fd4e1663fdb
SHA2560c3c08994b57fe447cf16d1204a5062c6b8f7e48ea3d91c4b2ea539bdcdbce99
SHA51248609b5e5bc4a4030730e34fb43b43ecce003a59606a8e515689ec7a928104140aca948d21457c385958699b006ef918e4258520a1356325001d403f58e6e078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a508ebf30aa03e2c5197440efc33d04
SHA142292c975afb4042686d77eb41904a0de92e825f
SHA256719e62b9d4b74aca3233f9467dee70c9e12d45e857ae756cce4b87baf778d324
SHA512b104b705e6554aa4fad7f6883b0eafae8b7e422a27983a2fc41508624d45b1b70190da9aaaeb7fa8ba8ad326099b015b0a2333276f878670c47a114525e8095c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528262fdd753837c32907b734044d9273
SHA159a312c6e868001c7f38603f36dab4a3f51d0535
SHA256246d412ec29fe7c5d4ceb8ec9bc11a9412412de837231de23c10871020e9cd06
SHA512eedcf9f0a8b719237ae4b353d60913d3dea93e77f76caa90f9080a8b9256263deb0c8980a8139d004987f151e5618f1f6f0e7dbd638c23fef2aaa248ebb5fa45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b45b08c2479445d9ff2c66e386f59f0
SHA16ae3fa791f43c867bd6b53fc316ae30bbb7fb38d
SHA256aa34cc49d73b777a7f4507dc3524c611eaf4402daf3ede3328c288282d4b2883
SHA512e98f65bcd303a690268bd047fd6df9897eb29b3f71a6d8d55aa9eea97553e4fb3e5f675108d5a1cf17a0227cbd2fb6f12ab13bd659ab3d1f9f6a8e83f3d3389b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b