Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
8671a53932be5995d800b2cbdfac8d19_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8671a53932be5995d800b2cbdfac8d19_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8671a53932be5995d800b2cbdfac8d19_JaffaCakes118.html
-
Size
4KB
-
MD5
8671a53932be5995d800b2cbdfac8d19
-
SHA1
a11e6f80e98578da229cb46872e041425db8c3ae
-
SHA256
7a575319ceedaa9fa584d668f2c83efefcb926cd37548b661f347a54254936bc
-
SHA512
1edc83470e50276dbe42c04bcf3e068f0ad470ff4c6d8a5e1ce30f7da30b15d59db68e2c9de35f6932c5bc6fe804e7de831efa604db4859112c38ada6a908e04
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1dMTd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d5689c102daee0b7fae432713e238c92725d4bac2aa462ffd79f304b62fb012f000000000e8000000002000020000000b94a823e81b73465a34703ef40e902a053f3ac672e92ea641d98d619d9fe395f900000007c53b960a89617f16df50457321f964fbf48af46da1c7cbf9aeda6df09f2c9c4808f4aa6e76f81eb05cdc0b7f22f5900549405360203722528a1f9dcbde88e79f25871c3cd4f13f66839bfeeed44619049e7cc026752def76ba2b83ff4dbc9db8347e494455d73f1b61e02cfa986f60cf234558664cadb7b769b891709ec151ed4f9551bb07100851c3966f5653591c6400000004cd59289d9b97111e5bdff1962cd8ada7ee9db875eb855b115539a77613f46ec5e8723ce1bebc60cd9ef2b8958f0bb2333c8ff8ddc2dc92f398097e11e522c21 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423307630" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000debc5f0c11e2043033684d60b614560cf2e000ece0e1727aa7ed6395158ec71d000000000e80000000020000200000007adaf0c3c49d745e0234c8eb1f36d814de19868c6ae00b962234b5afee5627e920000000ec43f1a3dd4dca0489d57afc9eabdff878f5983b4ad412a0fd1596d6c08d219b4000000000edaed4cb6fdaaaf60cdfa8ce9bf6e2e2a5b2ddb55aea016626bbbbc4cb8ae652a4c5a8905244385538d0b4652fae22911e10f20a4bb935fa4ae4d812fd77f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b094fb6f38b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B697041-1F2B-11EF-B5B3-EE05037B2B23} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 iexplore.exe 2076 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2720 2076 iexplore.exe 28 PID 2076 wrote to memory of 2720 2076 iexplore.exe 28 PID 2076 wrote to memory of 2720 2076 iexplore.exe 28 PID 2076 wrote to memory of 2720 2076 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8671a53932be5995d800b2cbdfac8d19_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573a7c6ad8b17b873e1a30defc597a9fa
SHA196784235c4b9e90ecb9a6235295f0d0020d39710
SHA256cd4669ad53d22bac829b0ff96cec5d31ad6b70d7c0fc61db7284ba11ee8c2889
SHA5121983cfaffa63840c60c2f5a5be5b1b505cc0b1ac0a69e2d222f4fa3245ae83c5837475e8811892192c24f63f20f0532b972925e29feac874f6748594e08c35ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1501cab8278570e438d3ad0a5169571
SHA15cc03a583b5cdd38e3b7df80925045100ec42f0b
SHA2563bd0197da95a98a1b3d7847712d3ab40974fdd263bd362028d4499e9c6b18bae
SHA5120823a04f93dd69a084a8f05f058fded441b4e85040186e4a3a7629d940c67bedf16eaa2363fd310df0077f37865be36342d08ced82fe2aa524a7503fb1cf01ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5162d10dae7308482b7fc872adc957a1d
SHA16604a13d9e2a9631ed7d2cd939ce24ce69e7d37c
SHA2567db4d0da3ab6154031e8c9ea4ac0a547811348984c5abc523955bcc67dd455c2
SHA512928105c1f71de3a8e8731cc6cc605d886f5d4d4969648be38f5aeb66fbd1367cfbda59f3f6569bf8f52472fa86470c4c96031b36759cd0f88ebc39e518d08041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567190a09973176e8d2c363d07d10286
SHA10afe18d70fac894ad14baa513972264bc8985fa4
SHA256e5e015fe91306eff445c3aaf0713b7a9997c487f2b919840159271a9a675a2ba
SHA512f2045486963279a383a39b8980e94a9e1b389449d395cd955c9bb6321d82421735c77a3c60829d90a4129dd830983acb989fcd38f7349419a5987be1e4e62eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54754c2612d3104fefbfbd46a587a8236
SHA1ad54be85cf532d5e32493b3234cd9f163d4d34d0
SHA256bdbbf4926eb2d76cfa058fa1de37d06c9fa11386188c8a945ee633d9a3846643
SHA512a663373fd4777eb5a0d0dd1ab0cd34a7833fc8adee47944a6d407bfb5a17e3638a2b817fd6ae6bc7d2ef4f21ac64dca18dd07edd8e7d088177e76b6562838a68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562b23f3de2d379f2f8908ba719a3d1d9
SHA1d25c5880d9c0cbfb11ddcc11540bdd8a52341f7e
SHA256d28b863167d3bff74c5ff15eb90e8f2501f8689d5af1f786c9c519427867f338
SHA512b8f1cadacf82671ff9da334656e004d017564f45a6396356b9ce4de09e7864f3f886efb1a1889f50c3494d6ac79cdff182871f5e6bd4b8151e44bd43b14b590b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b9a51c45be0696134eea90902bfa1af
SHA1d266f5c810e07ef5c0191bd3868b0055bed8cee7
SHA256fdb4b1be4ccbf63c91df64b59115bf46b66f6bca7eaf57686a31cbcf56ca67f8
SHA512d135fda4ade358c1a7d0fcfaca0489614f44bf38570bf76e5546b9f46ef5c4d734683a6e2e487f156fba3dbc2848bdc82c61d72a69beda520edee639271ced03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db7340e2c4cc8f587fd0fdca20570c23
SHA11cd4cbe2e9e86f2da848b9e50a332312c4b77f72
SHA2568dcb61e362381ec283253fb2f8f1e452216b1bd77fac44fb6491334b9f2aac2b
SHA512b16d38511ed71491676c276293935821e9e7d19d4246c53befb94a1eee1e64a8aca567e85c16c7058d4d69c929cadfca49bec7eb295e19e754e9211b3df8d1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb4bbb62fbafbf295965b93e104ca901
SHA103da237bc0fd37a16faea1cf20fdb99a8b6763f1
SHA256f4c5bd0e324bb24b70f8d4d012b945d5c5aa8010629eee330a5831e7fc52cd81
SHA51250fa5c66ff5c572dd0e86b244246b9c2a572f14cd617776195f8405dba42570058b767a10d1809be85ee9d06d34aa43133925137bbb1881cffce9a5e37b913c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524e73fe9907b6cc336c40a9b77e2c521
SHA18952103ffa9038073c300a702db4e2d9dc9229f6
SHA2567541fed7aaa1cb2b1a86dad8f1a47f8d907db761cfe7e77bcf98583979e60b8f
SHA512bf90cc293cd18c40d0d525f6fec30ecddfc3a91d196840ef25b9a9ed7db25b54d14be32543bfe114d8bb847b5289248cb97fd65c664c2d5daaefed199ab032d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5666cfb29864c312f68fabccd4246530a
SHA138efe9b6aeab7dca47cc3cb7ef3c07b11727ab7e
SHA256382a0eb232acdf5c4701cdaa5e124ca3f2be299a990ceca59e9736e89970ba68
SHA512e918f7f079eb7c1631fc2d0039d27e547d22abde3fa22d057907e4119231a96d5572350affe60ee2b2b1c7c153d1b3bac062a7935cdce03ecf439e38dda581d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6b969c8564c0f0ccb531caed5c2eab7
SHA1777ae28b433e3244107063f6afec4457993b382f
SHA2560f12c4495d03c7f556fab175fb462723ea252a7f74faa1ac6028beedbf6c3e19
SHA512a758710864f6920b06ee193082c4e35adabc6237647245dbdf4614d16e087b562f179b5d80bb4227a18ecc37945fc9608e6f8ade5d4892b0785d46ef6d6cd8dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5374998bf3f99848541ccb34a442305e6
SHA1b3be2b2bd8c62af47caa27d21e14118eafe9884d
SHA256ebe9977ba62576ead62f0a9b8fa0cf3561a4ea3084f25ad913d2bd948d055a0d
SHA5127117294cc1f10055867f4b25a5a329acbe6170594abef97d8498013c7e377ab1fd9f4440cbcc85a2f9387ec086811e93cd57277065048fe89ba09614d5feb435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5839682bf3c0e79a0704c7debe4d4e007
SHA1d1c3a00f95217c5d8a84ea0a1210069e1c0825d8
SHA256d03be97bcc5281347ceb20029071e4eb216e9b1da301421ab711d55c1cea693b
SHA5128195f93cbeca2214491d0fe0c0cac3525f20c84e39327677b103b1b33512a742c2a4f99042fa34ed5ac0128b854b0c03faa7c41637c9b159366c52a27579d0cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cc721e496c7830ac685e5fad4be6dbd
SHA1ef80734caf826218eff6d2596c12643be18c5eb6
SHA256f6ccc61953428ef33f332f7e7ab8c4bd4c493468a9797d7c30d27599c1d6f45c
SHA51280b885e80a0e83e959922d191ca2c4804cb8118f2b3f49b6afdb47deccd1d96e9a01cca9f85c7616d244c394ace42189ea3f684499d77450f6f95411fc78c265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d1cec33a33e740361f9ddc0c731900
SHA1a1c018cd873626516c714b665d9334b164690e2c
SHA256c5059cb48a54ed502af9815d4ff8ec38276c8fdcc576734233f472743ead9a36
SHA512c4a77aa81cdbf2505ced5f62d7bd3f5e29657a68d8c5e878b3d15e8fc75dcb9cc6ea0ae12866af159ffa62485f29ef14fdb8b8a3fae05bc67525b0c26b843872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55086be630b6a5e5511b7c0b3834a4b42
SHA10a29761b1375481f948233939b0377e22288fc7f
SHA2562a37eed636bea47a744f8581d52806a3c612cd05d69269714c4e9b885cb187ef
SHA5121db9cbcc468b40b1b2b1e3436114c43521a3822d247544df4e14b45d411492c6145a81d6aaa463bb9df7683d4d1100b553d19fd7688424be7825d3210abe13f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baaad709dda8afa854fbba5ddbf486ae
SHA1cd377a3ae9d313aadbec95009cc8c4b513462ba8
SHA256415915fe65e7b3db6b2687dff825b49c11c4859c395170883d21c9883b08201c
SHA512338b94578eef84efb80e0b2a72343963fcb5faa2ee5e640fcaaae000c85761c10d8b156bf62b5284423cc6510e454ed8b355f0c15fbd10ae10051e4ba4ae541a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b