Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
8341399e210e274fa21d26a669f160ab_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8341399e210e274fa21d26a669f160ab_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8341399e210e274fa21d26a669f160ab_JaffaCakes118.html
-
Size
461KB
-
MD5
8341399e210e274fa21d26a669f160ab
-
SHA1
9b08dcb33e91246995b0fa88622001536a378c69
-
SHA256
ecc9e2dd46d7c4dacb05950c0f7cc8dfc6913df4d6423e23c7b840e7e0798ea6
-
SHA512
89e4bf929c5117921908bb97b6abe0257bdc5c5a3b1dddafd7f0abf7e596426ee0adbc3b5731424e7c7ed789c895c9a8bd0708a1cf283af8026ee4db70ac4b12
-
SSDEEP
6144:SdsMYod+X3oI+Y9QysMYod+X3oI+YvHsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3f5d+X3J5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423211237" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CBB3EC1-1E4B-11EF-9DC0-D20227E6D795} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a9820ad4987544ca8dd9549ffefe94500000000020000000000106600000001000020000000baaf7195a6e1b15a53fa1bb4a6c06c2507808e14ba611914c0babdf5115cb955000000000e8000000002000020000000a50053df4da98ffe7cde142bdbea64669f1b637ef435b60eca68d2e10badbfdb20000000cef820c21faf6094a342b4f308a040831f86cee2ba2ee67b5091eb19493df9fc4000000083698c98a1a084c1fe4f955865879d8b6779ac71af2e58896b1309bfdd05ec80600985f7c81ca118fc2eb0f81747427b7c18428dd590b7a3703665f2509d5024 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a9820ad4987544ca8dd9549ffefe94500000000020000000000106600000001000020000000669fd783f58dc3da89cdefaa7f9e4fbef3a5a2a0b17ddafba67029ceabc4b361000000000e8000000002000020000000c2accd61e3d34e66fb46ff60a97923ff508f5032b55ccd3c42ed1adf6327807190000000ab30fc90b519e108d7c71835dd563a1180eb681137427f34af3341ef3479bdcda0401c505a20869d77305b08934b3d45391f6f3fc5706b7ab9cd93dd0ec588044f671574547fb8fb757979ccd496004ff835293b51cbaebf890edae7d667bf17b07c6a1a3c9f1aa39c95ca4f749fcc6a5c88a103bc340d2ee5fe303f86703b7cddf5c850a443dbdb09c7fdec3a606f4140000000596a9591a997d29f5fd9a8fd4fabdeb377b2fede4e2f0288dab2073fd40e2595218368a3c1b8911fdcef305dcbbf1f90366cbd8e553936561a1129c5c33ea50c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a7520558b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2196 iexplore.exe 2196 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2972 2196 iexplore.exe 28 PID 2196 wrote to memory of 2972 2196 iexplore.exe 28 PID 2196 wrote to memory of 2972 2196 iexplore.exe 28 PID 2196 wrote to memory of 2972 2196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8341399e210e274fa21d26a669f160ab_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9fcf00189da1e4abdd917f8c4152ef8
SHA166aab955dabb1a2fc3ada683a785f26a5d0b8fa0
SHA25627ecea258cf34468d4739cd29f77e9b895de8e7648fba6d2ee1e0e3493631d22
SHA51292c9284153f8d7928c6014fe693bc61c96fdbc71bc0331e0af2212def331e51f2bda329b60377c7be7432d23e41b7cb4f54a70818e5b050dc7144871bac72ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f5cb2c4e4bd370c20f758e36bdf3b57
SHA19c4026d0016c0ace46d3b8e1115b9b78bd7c7f85
SHA25631afe52c155e8dbd46ad2c232c3cb53fde1f88f591773a589fce23b052f96acb
SHA512000432d7db3f3b85b898be25dcac3a94ad6afaa9c3b8b63f3452ba84bcdd0590bcc4bd54cfd0f8d39307ff6fb9b160e3e0a14637eac98b43a6a0811f20fe47d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54990bf906035bf4d80986a638734c31e
SHA11ec1d33f5d1c248be6140406809d2bcc26b60859
SHA2568ba7f3cf995a0a533621d8901fa7f9e84f5b56eb80b58b0e01d2f4e7879373af
SHA512f0bf343d7b128c399a07a1c923b2c6eb58e379263c9fba7b29d7da35ab60e44cc6f52d3ecd681839a3c760ccd28e9eaecce5ec7ae85d00b320f000958cac3333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51055f5c41473a10b9277d37d19f1277c
SHA1696cdd7c61f4b9e781ab270bc77180098833e741
SHA256cb790ac922cb375dc54fc5789a214f5eb63f952b75969ef75db14163d4dd08c8
SHA5126f231101672d52dd90f0baffbb81c3de9ea54dd3daf60be61772af544abc0cb8ca015c83c12fdb79e5cc3973bd863bddfd3ffbb7b64390e0cd9e040447bf2b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c019216a3464303d5d73b0a9a1987da6
SHA1a733d0c01f023e0b24e62691855ac547eaf031e1
SHA256a17167516dbbb7d36b722185ff3df513faee5e11a4bd6212ddfd66d07318541e
SHA51282732756fad1d2b527394536ea27f3ce6b8a7f60128052f2a82b901c6ba82e4cc277f8ed5b4cb108b09d20219650f1c3e88d23d22093cebc498413ce08bcb594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59da432e36746999b4c8d8d517be195b2
SHA17088f603dca477696870d9a50195f5beb911d132
SHA25662c5318f61fdbd36d86625dae09b305b45cf2583bc675de1d9f1578bc60442e3
SHA5128f1c040e34c07faa1cd48498e48896ba7e6bc8f27763658db0d15629d6cc5e8b0ae5a3e2e3443b2c3f3378fae092af93a2e2dfc4acd87dbea5c4361c11261dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e72ab3ed09e21714a83152079cc90174
SHA18f10cf27e6850114614f7e655c20017a5fba4bab
SHA25681ba55d2d8b5075add1417f82a6f4ea7c1ae408c252e954d8434dd64adcbb954
SHA512797e66a31442b33b07ca1cc96a96527d0b4e4d10d01f7aeea0cd5fa0795371dd05686d868dd1804ffa07f756044799ca1560376905240369276c42a63fd57885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501c98046f430b8c6eb6eb3025388cd44
SHA1dd3fc8f2e11a193e9f870c07608a6da0212e53c8
SHA256eea529d1894f53dd482074549172d302d4cfdad99821e768429fe52b69ad2153
SHA5124e1db49165a725f691b86eee3b8fec03fd6d02ae2f5cd8c3ac94c9f0976871c9313b83373a2a8e9217fa6e29346c20ea17aeb923603484a654ceb61ad46cf2ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d336002aaea516aab660bcff87d033cd
SHA1c3de684fdef49af2ecdd1db84f3fa14af8390bd7
SHA256fd8eeffc20a2e1ac03e0a00b0d7921633f38300e99494937576ecefecd046fa5
SHA5125b74da5c7d6e76a0d3280e05db892f0cec4ef2232fc5f3882a34abf18e36d7e622ed81f686b118865fa74dbac5fcaf6070fc88f17acf86bf6d7995ad59eb49de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544731fb298b8ae5f162dbd48224ef929
SHA1dd35cd4c8d63dacf1397d53c10da146278ebb0f5
SHA2560ade10271972c94ca6cba2d1072f990f82a2bc60ebcb24760fda336dbb522c46
SHA5122ccac39004968087eb203a282937f8a1461c847847534c51deb276b809a765b87321b421de70fa68bcc727f3a9430c7894252520849a50b2173897a0228f6233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5776267f2773ada95e9e0d287aa142109
SHA1ae0bbdb4105d8fd608855a3519e3c346131f120e
SHA2566bca89bdbdfbf68662b200a25a7b37bb7f28a4271bd9759964f924f2b0db37bc
SHA51264ce5bc5770520426039a0e0723e41d342943cdf0aa0fedf672c3a33d4e9b31ce298c4fc7f8e36112f589b9b98863af1f2abc2b69a9ca538f94c43571ef7ad4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d4ceb4b5e12c31a23e9d919faea705f
SHA1613b60fb0222d03b6802e5b3367fa220f1553044
SHA256f809c38b6ef995c10848d250d9e31f1f535d588993d00c525c091493267f0196
SHA51281e86d8af23524f1ea61c85e839958a3208107fb7f8e0cc8ff989954cc7c879563680f62a05dbb01097b82baecf8322d38d5bf35362307f5a3abfcfd1a15e836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f80bfb8f69db619fe440de7dec45478
SHA17787adb3ffe4a5b00ae541f164c7419f85cc10db
SHA256d2d131e878bf430eacb8371715b347c86a30bbaf215037cc515984dc1fa1ceb3
SHA512d8b26bcbca0c81d6ce78cc42166263f0ba807866cffb6224a75fad911a2eae2daf626d6608bcd70a77da5998cf28c6f91553eea23040a4dc17c63031df357123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4c75c74bb6bbc924388e138013d13bc
SHA1863325be91e6239770b05c434fa8da06fc9aa5eb
SHA256c26c9b5220bbc6036a338e8f6378464f32a89207bec8eedc6f32ceeab468f1c4
SHA512e6958b1e01a2d0cee8122091d9d91449d78ad141f8113f3dc471649281279ca7fe074688200169466ab54293a8d69ff91a97073306f48884160b3b3290fe205f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a346ae6f64645b1a7ea472e8601237b2
SHA1211795c6be397725946489c6431a0792b846c1fd
SHA256772b41a0e1b018bcd26081e372704385c98ab628b31bfb0801bc40a2ed6e625a
SHA5120fac28e7780380d9bf26bad1ab6b50351d97d157304bbf9211744afd36849be9369bf210b954b452831266df812b30863a656fe52626192db161461c423f679d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d098b87e7bc30d8c23a1e62bd179fb7
SHA131f0d4eab341c6094fc91394de85bd435d614c6d
SHA2567e7b0a1d1c0ba39f76322f7ec3dfef0346c32d9941ad2bbc2624ea28dc1bc311
SHA5124567ff2e502c195b78bc9720a549d34991d91baed3541a1b24ec739e34b3571ce9d0c6e4afd6a5b6d35759b65e12033768e3a1c6749893d645816dcfb34fb81b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb3f0d12a251023cb7715660ea5aac8c
SHA134a75f36678af1e3eaa7f1c35d793672c951f5ca
SHA25615fb60ab20c56347d79286fe93c66efe23be7ee5499ffafdcf2c4d11df120d39
SHA5127feb3609dd41d9e20b43ad328bf844b4c7b8b43281bfa44634a528121da61cf403b711d7fe72fa3fe3bdeac01eb587e6653f721c04d8494315a4a7a24891a989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56efa8215fd6b8e91f9f469a354594d1c
SHA10fa8349f5dd4e10ff4491ae11c4b167c25fe7238
SHA2567d7209960666c7a2eb8dd83ab92ed8dfc1ac6406d5c799f0ab122b397c6ac28d
SHA512e4352564f4bc872d4daeb3b876b092fd304976243afe12c3fe70f13053b39b0f4a65c1ce38424242cee44d348ff31492aaf4ff8f1843207d813f099f2cef666f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b