Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 22:44
Static task
static1
Behavioral task
behavioral1
Sample
889d79071f90861fc0b2a4a5ec6050fd_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
889d79071f90861fc0b2a4a5ec6050fd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
889d79071f90861fc0b2a4a5ec6050fd_JaffaCakes118.html
-
Size
43KB
-
MD5
889d79071f90861fc0b2a4a5ec6050fd
-
SHA1
2d76485fe12d1d57e6b3ffda49403d0239ca24be
-
SHA256
20935314c60ba155228a98eda2fa323019296208056de6339b819ce845b1cea9
-
SHA512
023a3437efb1d1e8de9670b757e441a833a297ba9449ef8890494b7db4dd3b5840b94bd918fb71a8c64a6738ff6d1f4b13ca784eb3f78c76e479628a339a7fcc
-
SSDEEP
768:LZuITcgG21IkkxPofdVfFfzYjBhPf8z5PKD+XJPp5KmFAozVSEtn5ezBeDPPnkP0:LZu0cgG21IkkxPofdVfFfzYjBhPf8z5H
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423357321" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c51522acb3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e2d76d165172645977514224a641ed500000000020000000000106600000001000020000000264393f12558d408ea8f73ee749c23eabf53b5aded0179d45d67086a4666a7e3000000000e800000000200002000000088a7698bc4fe3c7ef49fb352c9dc4a6f865881401b611750d696a2c704da718820000000885cd92c5e00fa077a03473476f15c1219615e0557b82de1222257c6d6d75cd740000000b9f26dfcf565e492a2eccc29259011b0998fecdceb48bb4f7e9998f3e1f7bf6c86be101401833b53ecd8ae5815ebdf9edbe648937cbd66d20f89c34d0dd723b8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e2d76d165172645977514224a641ed50000000002000000000010660000000100002000000083007645e0cd6e19d01263447cfeb5ba4c55e237a2cf02e590c40b90301fd9be000000000e80000000020000200000008175846ba7ec5c35c3bd78d592c5442bf565c81214ed540246efad649d9f8b6090000000eb1799935e49ef6dd1568ea7a60a38aae46475caa8caebacd9eb542e7b21c503d1ce7631bb36bccc321bdd9e811fad34075e388a533523a57973f2c6a094eeeb8700ce55a4b1ee4763af5ccf093e8ec51f8fc0c828922792f6afe9635afe9dee017f753a645f2f3591d23bdf195174c663f43415f26274c94020a7dc27ef1bfbbb8d2a377662e06eaf2df6103fbfeb30400000007746fcc66d272ba90b400cca506ea71291d44794738090581a1ee737e7f7faa08ba0ecdf79aad4a602213d9b546fc41bbad9d8357ef26b739044577497484ff3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D983301-1F9F-11EF-9A72-56DE4A60B18F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 840 iexplore.exe 840 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 840 wrote to memory of 2744 840 iexplore.exe 28 PID 840 wrote to memory of 2744 840 iexplore.exe 28 PID 840 wrote to memory of 2744 840 iexplore.exe 28 PID 840 wrote to memory of 2744 840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\889d79071f90861fc0b2a4a5ec6050fd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3590e3a1c3f885cd7817156b9645ec0
SHA1182a253f7895f55ea72f5d71890636b4979cf6b2
SHA2560a5ad1d271a415f142903d90b758d9296137fe6c2083bf335cbaf25597731ea9
SHA512aa55e6152bdd2c30bac03427b727e0d8dfc623c50d4fffa14d7a21debb1692a062fa71aece75b831b8f0979699ef50a9e4d7c16b5404499e2e5fc399074791c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c66e7f82e7403c3fbe0780cc8ed1d7ca
SHA1fca3abe312cc5b40e919ae08bb89bc1c5d2cca79
SHA2566cc833323d6248263c5b3c3d291cb2f53157f59525bb84031b6b57df147f0faf
SHA5123d452c2f0d42d3108c3055eb15d43bd675cf5f2ff3f12814064d968254cea0f4daa9d86316e55a75db0dab0af75f5ee34ec36c57c9b67d2e2532d17beec7860b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f92559656741c785b3ded1b9d0898c1
SHA17a0bed84bce3692b3abe55c0d80f63005ad14cf7
SHA2568cef98805fc52a55c48d1c32a189e0fdc46d912c6285c88768ceaba9e318f07d
SHA5123e4599e7adb0b8306e68fe4280f087b7e2c42ac08a4892b6fc9f4c89a33c013df216f324a3be6cb1f2d1ba3c1475ddf636bf48e5eb304612b8872dbf649db1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a24b89466b697937893c0db364415f7c
SHA1d28720a7765cadeddfbef28eead080e03262fc8d
SHA2568a91afaf1c694ee3ba48772a97d48242487cb9c028cc069dba87626dd2af8d20
SHA5124b130d53642ff54ba8d5ec7a95e1110c0826548f3e4893f0fcd32758c3643b847737d2e642fb6e0b7e7d5ba244ad61eff3fa8016c9261a808bd452ee88d1d65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dbafadb488a4efed20ed0c0917623ac
SHA1742993ece2bc0148cc6e5ea30610bd3862d40a6a
SHA256951d60c7e1b07b4ef7336a68361edc2884a2c708b1b8001cb93759db6109aefc
SHA512baf22fc3072c20ccc7d1ab51b6368a47adb488740f763b1141f1f0fd1389bfdfdc669ca88b410bcf6f4544a519b9c24f772c892c0db2a10a4bf0d52b196e7447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad55d9affda972c016c93f787d75f16e
SHA1d6c7a1ad53f1afdbf218d159f8c45631c3390a25
SHA2568ee4a599099a66215c7d4c11996a5ff4ce62f17c90cf30dd3fbd4105fbbba375
SHA512871f7cf1492a5d8b9e7e946fa27d2cfbdec159640df57acf8ae34220bf8172ce40227339f57d39acb0e312a4e92aafafc72e7a7c6d9f613588d0ceba06ca7c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513bf33c3ca6d410af1bede51a3e13c6f
SHA1b4d81f48a7e27f5728266f16bf63fec578524727
SHA25613192e6fd7633f8a70ab4df1f324d5b833078a96f1b4f89d7330c284d6ad3ca2
SHA5129e6a447ecba89599522385f95b022c1640643b1d4d13689b6bc0eae570e2ff208beb56d76317821b828eeadfb2a953886182342e32d457c4bc98aee86d5d0ca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e9208cd5206e0c517afcafdff615c31
SHA11130909fd9797e7bef71264328cccbc807316e30
SHA2562320d8399e33b33e5304995bea9990ee8c9b55c807a4415c85fb58b401eae721
SHA51217e8c39dd5768d173e82019f0d56cd5c6df21309183829b0a6a6fcd465df43d0dc5d4144b7f317113acc567ce737471188a0bec336d6cbbdc41a1075140bccd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549992331846fcb9ef46bb96dc4cba59f
SHA15e4e9dd0bb8425975ba91db6028e75ce4c0f4c1a
SHA25647a36328a6ebf4cc7e1dcf4c023738e19da54e6ce382f5728ad6c70cd7c861c2
SHA51214bc54ef568d2a06e1e9219573c2da34191090966fa48e43060a8c9e7dad47b3eb8984c8351a71459867751966b9a6c7298b38dae1aff33ef6d72c1769cd618e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edd1cb93f7573e23c3804b0343f935b6
SHA17e9f6637e795b0cfd5c4f826bc09074cc80718b2
SHA256a30931284dfeae72322b0c7c20928e830f70084af8a5f4505faadf7b7014e5b6
SHA512518c3a2e755e41f0554e19669fe97cd018a29f08db67a8bfe92291c7019b4fab3236c0e072c6f09bfc92bd876320312aef41aa4304fb16f45f209dff7da32790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2ef33d2cdda869a21a23ea793a9a5ec
SHA1cbc0979394efde8bcb32eafc8052a0826dc1cab9
SHA2568862e8e7d8486e0f7b25d1225de6ca17af7beef19a8ff8d2fa50b2578d525fbe
SHA512bda5ff022582d313ccc82e59c35904c535d71767b81e835bb77d3b147f02fcd0ed365937950e6d02a28cd13d5b54333347d8bfb46ad7f2e3afab53ca243969e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bdb5dabb40fac76fd38ba2e90e99f71
SHA165987fda26f65c6f35dfe0aff3c84c0efab95ce9
SHA2560c338e366e9f4d4f21d3e217df892ecf4c8dbed243631aad4d685cd52eeb46bf
SHA5122adf6dec07d1f3592dd381f907149a3678c443ef73a527f2549b044faecb79c9e1ccc25429a41df5a37d1546c71af143213b05f267ec07ae63a1a4d1d8964fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506d4717e3d7960f9eff39a56b44966a5
SHA1ecc555b4f992142a9ee770f0d39960a280b605b8
SHA256e2a5c0bee9e0257c2ad73b7f1bfaba8cb7877ea6b1285bbf85643a5ad7715614
SHA51215edd60151171052246314d915f11a2cc97069fb0c0bec57d909e4a85365cb1123099f622927c81f76c336ece714d3f3bb61b987f8449d46a205502695928a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bce0558e62ca29f61f56d377a0f1a58d
SHA1c2f984bbd2151c8c2d7a97b6fd82f40322be316c
SHA256df1826383479428f7607cc4e0eca0077bfbc4a089dcf8bf22306b9db04fec717
SHA5129df688511367b8015707b8e313c6c879d45722f3c3a1f6bb355a34737fcba04aab0546c03c7bc9a5bf4419b48b453d1c9b5020fafbf4bac3b10622dcd0d1afe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c523147c0df558a5228b527a2ce359f0
SHA1fcf9a8910717332ccc9fccf28850d8680a3d3214
SHA25681690171f2248c128b61be34a9a39c32b8ab3657f2254855b539458b393aee8a
SHA51254a5a1ec4f4e5311cc27c21bffc90165b46e9b5769ae48995e701062b6a4b4f918405a67d9058a41ade7eb897d3e05659bd53a2d9aaad67adc8068a1b72a5d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c8fd880081193b54f1326e7ac4f8768
SHA11be454bdad935a8919ade8519e0e764f251b49a0
SHA2566ce6954025f804a48387d36da02a3475abc736bae436d775ed199103061313eb
SHA512f0f2f2d3eb047e0802d31f9f51f5303c075429efcfad3510de7c4a4704afdb57589750421695ca364f4b0c219058aa98dc743c491fdec343df40f65e6e0a576c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3ce6f29e548012205e6edb53a224f82
SHA1f7351c5c5b93e051ae04eb41876f040b831f4187
SHA256ca5bfe825ac74bf33780c263e28333ff85694e858bee3ed0e91fe0e0e2634131
SHA5127162a8d958742f91a1b835b6ad13f6dc9d85ea1a0cae2105039bf7396be9dccb012c797ceaee7ff8e91bbaaa7a8a55b71bfb392e171e73797a16040ec804475e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558ed6fb490c67389897f2768c6bc14f8
SHA1235cad3308e7b2a904ccbeb661886ac7c2633e9e
SHA256375bcf9b13d1c3ce0bf06521354ac1e09fb04d94014003f5c1a5e5c039d89346
SHA512720208d65cbb927f930d11b047ba6a76f4b02c813e84596b13705dc83f6cb595442b8c660cf442942f3cb0de3785ccc0462c90931a0d91621656a374b882f6eb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b