Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
871533d8fe4bcace5755c595e997f0b0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
871533d8fe4bcace5755c595e997f0b0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
871533d8fe4bcace5755c595e997f0b0_JaffaCakes118.html
-
Size
4KB
-
MD5
871533d8fe4bcace5755c595e997f0b0
-
SHA1
27c8aba6cd772efe73a3fca3b4f469a0d68a9ebd
-
SHA256
b11f8fdabcf1185c99d82d09012b01e1c3fd054f590ccade46c1937f963a58d6
-
SHA512
37b11344a0d3296751c233f1520bbf6bc91d97912f313f885d5cbc1f17c85fed2feb457341eda99dee7f75d40cd6661d694eb741d3f7902dfb5fe1c3638ab653
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oKrsb+Ad:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000540afca3f92423a1b7ba3ee0ef1d7b44cc35a6dfb1b9675a08a9cac5221aed67000000000e8000000002000020000000fa74de67cc21b3a258a39fc2c9916c873570c244c1f94d735794ca639b4eaef5200000003bc1c297b927ecfd1e2cd5198912e5c5d9411ab0895dbac0981038e1ae139568400000007100681e6e66a68dfa3c4b3fb8076f50781785588cfa8c724e441302f5b175d03e300686019640a93988b6beee8664989deeeb47b79c9a281038d45fa1160637 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58B73FD1-1F4D-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000dbe63337b63f4b9f21a25eb7f741afe6051a2bb11fbda5d5b1ce96193657310b000000000e800000000200002000000030d5fc12ea151564ca699a0b132330e70ba707fa1b0b7c222e040784804c88cb900000009c22f81718a608ae4afe62c7d90a542ef3b0b881a9d3e1753807e566b93e470d455c7bf030f2fa54c6eb027c7039d29ea9b5822cd3e87b3802469fc228b75e943641b82367df4910020231131798d1c12833de60bd5151b6c0118ce1e7e83d8d71ca64c269d8005db8f4137330c5c21e24621ba14e438fbd4109881dd0b0d43d0a3cd756cda73884915bd8702937740440000000014c28c350f8e6739fc0dc487be46d715e90c5cfd19426af49ead930f7243d53c9ae293e784cc9faf6eacab0ea96f61324e5872f8d890edb1d8162cbaff223b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0463d2d5ab3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423322120" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2456 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2456 iexplore.exe 2456 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2948 2456 iexplore.exe 28 PID 2456 wrote to memory of 2948 2456 iexplore.exe 28 PID 2456 wrote to memory of 2948 2456 iexplore.exe 28 PID 2456 wrote to memory of 2948 2456 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\871533d8fe4bcace5755c595e997f0b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a54bd5ec3a1942252bec4176ff560a7
SHA1d2488960b2da78ddf7a2f22e84f084a9b696e953
SHA256add36ccfb482342451cd837858438167078df1af045586031e8da84888ce2b50
SHA512651d6d77ca290a4d9df5fa2d3dbadee79abd64a932900c802e4f622cdd80e04a9a2847925ac3c117da3b8e69603843ce696ae29e73f0110a7738d3c552948b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5c5c4b19c0da3e6f7a5230a3d509fea
SHA13f900dcefbb86fac29e13a3ed6170a1631a168de
SHA2565bac78d82d5bf0fc56f6472c0e5b3a7d42873f80b3f44a0a901f4f0a507e25b8
SHA5129c3b44a9e142c5ba0cdb2111a81e1146354c1e44cfcffd58127ca147bf71aa758d03c3fc4fe6ebc9823bc531b6f97aaa84d500243491efe3953f5ed385e7c956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e565d0794cbcee424c79089b6d9451f6
SHA1b1952fa77d0b0a2b5f4da5ce6874adb2d7d247a8
SHA256d09a7141b7796ef9424d96adf264ffac85642a1edcbd9dcb3fb272cb164443de
SHA512b32b2ede0b0ad3b6573935c623728db8416aa24ddeaa189b6faa209d4f180cd5396b3eef7d467d3716c6c7c73902599fb02a6fdf284afdf467845e8d5e29c1d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaee0d41fc6c6e1a5e09afb4db144a5c
SHA12e635a16921fbde84b917e50c0164d709c62a95b
SHA2568fe40e3c4a94177c7963b2de5c8e2b1a84c8332ba1b75a1dbecc4987d73d2abe
SHA512cd657363ecf97986d9c22612cfa95308105203f62c295ad8b631cbf11d900a65bd886da64f51e2f95b455f467ae4d203c62f419cc72220771abad97c085e7bf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595107be3e617cb26d1c588ddf2337e32
SHA1d6d1febb7fe087bcc4955ede1ec8d1f0b50c97ab
SHA2561b398a2e18dd6af119d060453da384fdd9d3e38f4c4a484ce1117d824aaec138
SHA512e50e21f394ec483fe688e8555024cd16c0de0ffa73ae1c9a68254e08185c6a0470928a16aa93686be0098dd79759839fdae9ee2d32b3c3236426e9ddfd4b3058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1a107c426ffb258529b2b5775680b8a
SHA1c6e9adddcd7d5969df6391b66a9d7f02792d8a28
SHA2568e658811b59df37911a83f27f37640468742e544868bd6acd1a87632455656f2
SHA5124f2ea15cfdeadb6a6373883d37c4d567a44dcdbd0250c21d8f0addb9d7b1bcdc4e3a9c063af4ec5e4de74dcea5c646ba0907bddec91ab591d00504e79eae2dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ac82c8e94166bb3f0f69b4b40cc118c
SHA174ad2e52a0faca9a89ebacba5940599fb1a656ae
SHA256ab34af08f6120e92656744821209663ee91b664539d059b32db4e2bc32777286
SHA5123c26447bb41c4949e2d292ee9358cfc7bc834ac7bec2283fa30e241e37cb3c0a1808f4bbf3d5f849cebdc7b6054a5662be87f21d71c824036d6840c94cb99661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbeff69f8738db00fe616a1d6bf68e83
SHA10e18bceb985b9f19e8f3c0b3205dc311cbcf424b
SHA2564187107bb0bb4b9d74349c8b2fecd861ac7c524c3dd3c25660c41c93c15b0957
SHA512bae020b08be131a518999646212c21ee272f430319b885c18ba29c00a4997af7d18b6bd8cf9f7bb6e6120c64411e5afe69e566da563f81ed1cebd7fcf0417d74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2b8653f7e829ea9503c746583675c72
SHA1ce53bab3e5560b341e77c49047a678148c980c6f
SHA2564dd286055b49caca9c46ae0f3753571a8fba6bef9b0ba28abd6ea12e4bb0a533
SHA5125944b1c98da1295bdabb9c44d30be961c4477a83dea1c02bd7dd9545a3bdf8808cd8f876232066957679db86fc1e5ba4458242113f4344b8279fb49f6613380c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a248afd4948e6b41f7c28a3bb195ae1a
SHA1eac00cf21ffc9591f2650734903cfe62188e8a2c
SHA2565fa4c0cde7d30c6c3b85693c640d32e154e1f387c68bbb696f5f7a0370c62318
SHA5121a6f6d19e850f8e25ae9df2458d7dc702d9a0a180fdd7d4e84ea2622065f8dd240996923307209e4a55ec96c83df11110695a984c0c7f480ad5878d1483cf349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b952df79380380d03258ff99454ff7
SHA131ab7603d86dac13fbcdc074e556bb422580b6f3
SHA2567e59520b30e12a5e5b37c0ae5b6fcb2009cb74c4144020d0111d062818a41424
SHA51213a6cad83e928cc6f67fe0f8a36b16c15742c9bbf94d9bb798d9341c751bf046c766080dc740c9c574556cbb6990e3cb2252bdaa32291f16cca6e627982b62e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ea76c0e91d27cf9cc183f04d3047b0b
SHA1cd5bf2365741c6496a590d1847179aed331f6d63
SHA2569edc77cb409b4e88192f83489b1ead1648520a17e01a15e569cc054a073c2356
SHA51279b18c096f49c647836c9ce63217dd10fb9436a45a18e4613070d949ee1c96ce2c5fc255304adc6f0b2a2711d81bbb5994275bd23d4ec41ade303e719ed533fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50647a7fb003355d88864fdd72cb7416c
SHA1ea904c4abb1e17cb7e2aa7a9ebaebc0e19a93fba
SHA2565fdf1490f4534d76065be866845b89f3515a208dc476870b23c6c3b3e9860ef6
SHA512c5f4d4a8e055cf605b8752274f6f00e2c2d04831b56937ed06c184c0b450998a8abb2c76c09ab201d02ab39f2746cb22601d3e1afe024940a49ec41643cfab2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c095d3fa1692c66ab842f265f7f8cb5e
SHA11aba69e85f0a58d4626b73e86e337d83ca18eeb1
SHA256cd810b4a7ee305411682fd509899eda9480228740dd714c12d51ee2f73e033db
SHA512aca8bfb49c7dc93a01a0391dfc954435ead6cc8055340c4c69828040657c7dac7cceb1b0d200f487f1b8a2eee98ed038466137813704832097113d649808fafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552296fe8a298d7df913e4e8deb79ea83
SHA1f0a55f3d77c855661a0c4c53b2c8c3809ce13aaf
SHA2563fb1b23bb34a2b4e2bd98a12e896df9270f79db25aa2dacf4bb36ced8279cca9
SHA512a3ec7a99b01bdb3e6e505cd25490e277e3efb4574003344d003132a9a52d3aab32b2c0c13914720fa270361b418b4391e99630b35b108f068f6298c9d43f4f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d00c6d88b20c1239c53757bebee8cfe4
SHA1bdc5e400f8d1de787a52a5f68fef6a11991d8d89
SHA2566c429c11fba0ff1075d6fabd3388108c776c0b14948297fd1447e65cf0aef916
SHA5126a84e22e9a54767fae61701056e16a95dd2177bd054e4aa04eacd3ddce5d54e6951c05131204186273d06266793299e52df841c392f3a032783ccec0657bdf99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1852ef5e61bea0f7bd4b9c9ed31de8f
SHA1c18c7dabc905f1f74f7f3b34ac325b3f68010a0f
SHA2560bac76d5990bb96905b60846dc34e7243122149b571dbe85a0fd4e8217dbb632
SHA512e8e3f428f4a32a23dd85f4294a893dcb4d2cb79ec6fb10575b3a2c1ee55266f13268cf29be56a8d4e82310142fa27ff1725b44cd80497440ee308d9f7aa0f668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fddcd1d660b0c528b90d950cd85bdd4e
SHA14044465c7d625bc1347b7766465dfcecdb538c30
SHA2567665b0a383a490b0b996e25a9464ceef0371bb84e91b68b39f0fd434764fccb1
SHA512f86356c358a6c4eb811f28689c86f6c4e04d8eecb32ff69057fa347b2b235d5b52d81fba0190dc87c526458adf0d9ea62ca7d1103f3f9469f5170f9cafe7a724
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b