Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
834160b0f982fc07e6c1358cb3381e1e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
834160b0f982fc07e6c1358cb3381e1e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
834160b0f982fc07e6c1358cb3381e1e_JaffaCakes118.html
-
Size
1KB
-
MD5
834160b0f982fc07e6c1358cb3381e1e
-
SHA1
f3053719335450996e5ea6660f4eb756795410d8
-
SHA256
e9702cfc68f8b9899ee23871a4aaba1f3a822c3e0fea10851308fa1618ceb10c
-
SHA512
4e308b2a74f9e9532097f56397de7b5fbdf0a639f12120f1554433409809fdb5aa4dc19c1547b63ad48f41f2c144344e8b9554d364e9353342d9dc06eab26aea
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca1b0b3e588b4143990774bb58dbfcf4000000000200000000001066000000010000200000000c24b32508126edc2973d6dd9160bbcb838c3b355f5a96b09323584f851d62b0000000000e800000000200002000000019cf4761b442c938a8e79991bc6b6910d47e2b78fdb19b2845bade931358322b20000000675f7a67ff6e202060f3477c6d975108923d67658cd1c356d1c7d5ba3d622fb04000000061f25fa4869d56e392679e6b2a0cc626cbcd7d02aaed372457aa08c84c8c318febfdb1503d90e55ced103831ba067b582ec7cbeba1192c262f82d707fa16ccf0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802522f757b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca1b0b3e588b4143990774bb58dbfcf4000000000200000000001066000000010000200000008c383f8bc83cc9d713da0e0455260887ec7190f2585d3ac65705cd8688d5dc61000000000e80000000020000200000001aac71f6076b1f26480ddc7fb0ff39897c855fb86c2e95a8f3419e10f11a8f5190000000a27a2def51dd51701eaaab9a58c7da73d854f60d0d97b35275c1c8248361bbef627126932e78c125814e724dd06f8b3a485419ed67709a617de7e15989fd461846c6890240499184acf236a1bfb28d26a021409b2334954d7a6e5920ec3b97caf2a177ef9cfcfbdd72c8ad5f135979e4b86031ce628ae0798a597a60c7742af6bd0052b121349ea209cc40e670ce71a640000000a43d4a5b9963d75d09f3d1c04f0e5c22d9bda5e467a4ce11a5e2a84a6fa5681788800401541d9f890dede1b8bbeed74c31baf457473ed2edf13468d383072480 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423211248" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33D8E681-1E4B-11EF-A304-E60682B688C9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1812 iexplore.exe 1812 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\834160b0f982fc07e6c1358cb3381e1e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b23270ae24a663e2280fc3e00a51033
SHA17da34f0d23b46021f3b1d88d57ecc792e361eb41
SHA256d4cc7b6e4c4726baada067880e8d7b0ac988e79526e024784df8025d4661f0d1
SHA512f0363f3169a6e0eea8c4364a11422b2778996382f42634112f17bd856ddfc42a0e7195144801d8799902515353ea684704040234bd5bcba75928370110f2131b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17958857b659bbaeb473fc40faf7350
SHA161e0404b0d268c9302e2099b55b8c24159c1b6f7
SHA25683d54cb1eac1c3d7d344b142e2ad269b839b5b1344e75bb2a1dea52a2911330e
SHA5122965a44dd7d8226b5ef14f31056a7cd5d098702ab1b0b42ba6856f20ca5a01e648629f0b52ed881d677fda33a64ef049b5ba9976ecb511ec3512e78da29fa198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b74c8fd2fd11193dac5d54a8fa43277
SHA1affa0831618857635f7bbc41a77900b7960d7c93
SHA256a4f605d12b96c687c167ff3c4dfdc10fbf1eb6c6fcb61e6becadb35ec403a69f
SHA5120e859c467a4a0ff218e880a770ea192e79d68d538c08b16c8bd2b031656e65d3ef670e5fb04774909015cbe3a922cae53f2d24c3a4ea7e50a79de7b88f1593ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5416398eff25ba0b9cb1c68d931d0bab5
SHA1574611b22d12ce78445b4d01bc2cd32a8e45bbdc
SHA256b519f2a5ea19d50773e6530b51ea87007d7fa1376438414a34abd39b77593a92
SHA51287229faad5650a90cf224e291f2e6b185cf92084ae63a09451d17e2444b8da7eac704b18b97fe0ef356ffeccf9e76716dae4ea238a87e727c9987d4d0943a7be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cf293f3ce21934ca268221d95ea247a
SHA156e00e780cee442c366afed43385d8d5c9857546
SHA256bbe684b1cd4441d872c501251106ce4b6a05be0cdf6aedcf306ec89d2ec2fca9
SHA512d5e1436f25db94ec804261d9fec5d36b179c3759dd3e8dace9d9d103f8542f4d511ce70be14cf019de2200b99d30a6f5ce76c9ebfc4ca7c165b2749a21931f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb0cb48e3160aa673267d3a4a4414ba9
SHA146f8df9a519ffc99f76d5f705e2077bc06521642
SHA256c52c737013637f04d6bc062d74f8aea89a1ff055057e6bb121f17f16a19d933c
SHA512adf89decad9ed14c19a5f9f20f65680eb89fd22b204c1e232e3fed815ab79c242d1b107897253a66567b9567a4e2716255097ab0fd3cf4bb3d7b3e7c421287be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f94ff9ca7f085d4592ca1a974ccd4c27
SHA19042bc11f95ff965dab8bc42def52b5696d8f966
SHA25624ac9df160caef1a18fcd9a3bbbad69bfe1315777ed978a01a88c7d083d8ab05
SHA5129c7f54a53c3d14ecb3d4c820e2ab335f4bcf1aad6f1728eea712dddfcfa0f14a94e2a9a0ced2a19278ca8f9fabd3a51052f6d1c1edb362cb6d4ef79172005e2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5eabd37ea4c2c8e8edf86dd00df4918
SHA1102939b82915710cd51bf4a1d250068c1261e646
SHA256dc59598508192646bdb8dcde6fb56c695405dfcfa6931eab589780617a49b303
SHA51268818d62cb02291884eb4b1acd82dd2d2565182556c4b602473e436bd16cf4ce22e36f9c58d92dce8e5a2920529fa9a5ccac494cdd67f0787d59907bcb53177f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ffb11bf2bfca5b1e869865c4e597688
SHA1e2da27316fda3d565406764b35b778bce9e8a7c9
SHA2566c31dcf4523b8f8c998bcc83c5bd63388afb7f891223ff94d77de0c59cd386c9
SHA512604eb9e7353a45fe0d842b73afa84939ff83ec7784dcde6a16b5e70e793666dcf220497626864195e657e9386a46cfbddcfb50dc0bfe99fb51df6d6fa4c7be5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589ab88f487f340683c29ef0b10dbe401
SHA1adf0e5e9ffe817f64e1a6988e8bd3bec8b1b0dda
SHA256dc2354fb97ff81cd2436f5c6a144a80d776d173b52b8a5706e839e3e847d528f
SHA51223815f8800476d16f4d96d53a1be026e88275a60c8e75a667945dcf7101b969ad6dad4c130da79cf9568096c009838afaf323a2d5bc6de1a259b03d7bfd35b89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561ebeb5b22a51246c81c6a2af71e3bd9
SHA19fc6dd759171dc17e2826d3138d9f94b64e8d8ec
SHA2567c9f835dd31be2fd14362aae4864153842b48969c7db1ba8b49cef8e696c08f2
SHA512735fbf608c14128667547530b9caf112ffb7aec0b30715825877e4540726c4426f37bcc89008e5e87611d9a2fa0cb1db28f96df7ee8c351a1b3e54c0cd2470aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa18c4a5cdc77cc5aeb8df59ba2a0a47
SHA1d7b14dc5b7b8601005e5b47477890aa31c063f69
SHA2560ce4958f6cd753d99d987ce73f3850e29d7cb15a0a5bfeb06e825e6217386367
SHA5120e9c186e4f8d2994c96f710aa7ea17f883cc9cbbc1d838ebc247ed16a801200e7633fab95d94162f47de315a0c5023549f375092c26278f18c0636338a872aaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f26e160106ab519f6711affafb2ecd7
SHA1bfe6751834d341988e4a88dffbda6d1d0636a317
SHA2563b3c7c6c505459d52de55d283bec77e3649b72cf499d25c6eed30c38635b93a1
SHA512a3f23cacb44e661cd32bd4556434a52883cad7ab20aa225c89e7bd779cc32b820455622372450d1f72a58708b89b24d02cc29ac3f54c55592bae99bc2da49210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d551f15b30bbfd12452e779ff32ba8c4
SHA1c228f8412797b25adbb3984c24b19913cccb87a4
SHA256f986cfbc3d5953c3c23b6562be6331608b72874c03650f89404bf323d01c08ce
SHA512f2bfec667cd1775040ed722f210b78ea71b83c7d476e943ad46341fd34059a4832eddd92de0c52350d2487551da5dde7630d6a100414fa822a1db19576e12592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdbfd69bced7b895c35895eb9ffdc7ed
SHA13b82ad5c725c2da153a9e1ea973e45f466937b03
SHA256a6cf430b4c873af5ee56e8e28e62d461fb03466c146985a16bbe9f49a6040dc7
SHA512eed78358e9bb7346a4a415b6ac0b7f8b08b6cc9980f2bd256b3aaba529b9646df5d76012fb54f74891937edcd86dff1252a6b205292cfe2847c101497be16b81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d05c49b4a92c0d20269257cd9a5385c
SHA125ee5b5b88c85e7a385d73e321f0ace13237c291
SHA256d465bea4fafe485b394ae71f741b8b11ac30ead8a2b5f81bef78f957932cb877
SHA5122dffd1618201d1fcf26263ef745c2df61a9608d46deb5085e2914ef8c21d90db69c74b82c0a3ac8a2ae864f1fd236468b75246c1af5f456e2e66c5a1fc3b6c7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550110604d4c6f6cd2ec11320f4a2a710
SHA1e32f038df3f2a89386b10604cf2a84e027b62937
SHA256a321efecdd75d7f37152593325fa69ebdc95ec1bb3400ea8a91609c731b5c26e
SHA5124d07cef8387669abbba32f6ca5c1a562418626907ddf330a2803b445b1cb5bd5624bda34bd0e83f1ed56f01e0f789f720f2b98240f4a8d1c9930ab8d475f06ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca003a8ed918169f117bc40b5f51e3c9
SHA1893f73e833c91f75a77cad2b02eb1c1325be2897
SHA2569b06a2cff10ee188bc339c53ca3198d83ae3811c475b37a282efe010cab58291
SHA512e6d8a4aa1872fd3e9d3b1da93e6632b3a1bd5980816bbfb9eebad564dbd58a29cd864e8e34607f5e5264af0a927045569ec08950efac0fa531b19ac2756fa84c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b