Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
86fb58273885a0ead7a3614d43086599_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
86fb58273885a0ead7a3614d43086599_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
86fb58273885a0ead7a3614d43086599_JaffaCakes118.html
-
Size
4KB
-
MD5
86fb58273885a0ead7a3614d43086599
-
SHA1
419b789686871d8c8793932dc1f6bc8893d4faa3
-
SHA256
673e36a1728499e2d2cc115ef7b91367c6913fd988eb03f39a4166ba0d66c1c7
-
SHA512
046616197a3b1e2dfececa33d68ab9361c50ddcdb74814a4a50f7bb8830b24f6ca9a016b0d556b3b6f52244b3bf6b86ea7b43d0d07c63a5faf16b35198695059
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oXoWHGd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD3
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CF8AFE1-1F48-11EF-82B1-CE167E742B8D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30149d1155b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d60996f2c16164bb4d146b9ed866b2100000000020000000000106600000001000020000000c5cd58ba4dd27c6ee73e8038bd641561f5a413e01af39e6e3af10a792be1cc03000000000e8000000002000020000000e5c8d1e11f77e2a75a38ffdc293ce27131030ae3fdf525b0b43b6d6fa273e0bc200000006de5aa95b07186834a569f008fceb12e52a3a82ceae4c0e6fc80c15709ebe1704000000098ade4a2e4a3c50001af7f13e6992f7ca08ff589621d51bf00e67edf09d38d3f2815c561fd22f6bcd7f6dba5364a21cded3f79294f328679dd834385dc1bcc0b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d60996f2c16164bb4d146b9ed866b21000000000200000000001066000000010000200000006880bf1df7caf9f4d1fa15e7def6f1034cdc366f8248620c081aa3e0f6b0fdd0000000000e8000000002000020000000613fc49987052875438b0f6675f26ce57b3a05dd53899f898e33945db29b9285900000009c09339209cae03aee634135087f6319f3762228a555e0a1d6ecdc1a6c635d21e25d70355e10bb424d59f14592350175d7141f35073ee6afb4eabce7c9321e8d66eaf7cfd2f750d11c2c3329436f3779b8d41f02ca27395f136a80369921472b5511e44cb7d994f423b75bc91a9bfda32f28310d9e41d63e506c0ed39fbd4028fdf83486f585e1117fdee2045b4d13e840000000ff32a3d82f9243d28fef644f18c58154fe054f5ac201b51d27e03638e25dddfe94f4ba823c8ef80356574c156219a1287ff3c3b12914ce8396e8a44519cfd9a0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423319927" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2728 iexplore.exe 2728 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2540 2728 iexplore.exe 28 PID 2728 wrote to memory of 2540 2728 iexplore.exe 28 PID 2728 wrote to memory of 2540 2728 iexplore.exe 28 PID 2728 wrote to memory of 2540 2728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86fb58273885a0ead7a3614d43086599_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c081ba13779e57e04a5caa2afd6f668d
SHA1cc306e7ac0177a33e247e47a26a2e67b55e7637d
SHA256de6f3d03e311d974c6e562587358bc451dbf8c3feb3ac21a2a2c4c5b296b0ec6
SHA512b207a1f592859f05c9160ee9cf061e9e3605b7c71357748bcbe820bb1dda8bf979f2fbd8a5f6fda6fa4b608bce7d6953b7e05957d67ba49a05b6b7a909e59f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576a6374f8931e327edb3b38e8fe41cfd
SHA10af3eca0c33ef5d6704033762c1b3a5a6678e491
SHA2563a3983b552562441ac1bea91ed4229c627907f18f89e533d1d4f0aa88e64be48
SHA512976bf60af13b9a1509128af76e826802f2c734c080dee39ca89d17b1df43b8706476b9b354031ca6f9fa9741c7c7b557c241fe7d4eb89267325e4f16aadecdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e7db078cae0ab5ff6858fc3ff0ae4a7
SHA1663a2dd839403eaaf7d06aabae66a37d46085e9a
SHA2562e02c65a5d98fb03a6e31a8540f8b29f777539a39c85f44073ce3e8aabfe0516
SHA512d8f5b69cc7ed666fa4dcacba498b95111bead7c148791bc9b4d263011e6f4f866c28a13588807871149404fb4757370e1ab43d8e585ccef4ddd9dc8e9a0aee38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d79dcdde00ee52c9f62da158ed698e3
SHA17c757720c952871ff8d934a6dd980abc1e4a8faa
SHA256a4d4ea9e71fdff49d15469a120932d401257283e68a79db1c376bc3b2cc20925
SHA5126f73a44f34817e9770e1bdd0d2522d5440c1884f58226cba3b80429578849c2b31a91171e73fce48410492feffb6d214f3f87394ba6c11f4b59b45429d5b7fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5506fb3f88b2c88f6f9825f72c304f003
SHA18168dcd5591f37d3d7d2681642bdff0243b855bb
SHA2566483a96d152de62f600f576eac74f26aae5878165f8e08e45c22361b1b74fd8c
SHA5129c8256eeaecbacd67c3b82ea9b29dd87de4497336d5fb5816af32e69b39ad6b6018ff6bbfa2ddd969aaba4eb8ac12612dfe7721b6e34078909c86556e5ed7f4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514d4977a6f37faf9449675c479f3e177
SHA15e3c437966d4798a468beb0f4806f9d815bda581
SHA256a3d4c44ebcaa198c9bd7eafdb4a725d8f890c7267d7027c45e3fb870bb06e46a
SHA5121cc1b1f2f4f8546576092171f86df1c9bf7581d7b6b8ae8d52b89959b3ad69e726635ddb1b718054232f68e0fa6394ccca65ebd6f733e7a1d5fd807f3db02ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de7c66f430b804af21371172a6d3ad2a
SHA1b3f4b6fa487b3cdff9d904449f8800cad472c8c8
SHA2563a5045931ef3659d143916a2408ff4fbca7facf656b04b0f38470fdc1105954d
SHA5125e1748c90ada993a59b4ae4a9306debc62a2fa1f03ff9f7ac43d24ab6f7d67d194abe91d1d43b55d8dcddfd94f89363af854f5c4adbef8c53bac7846e94d9fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f53e4094a568f1b36f5b828cd0afb94
SHA1d5757c15672ce9e6a7a1499147c655412bef2104
SHA256011691397f468bee53dccf1fe40268ebb6d7061aa08689514e8dd15785e3f55c
SHA5124e9ac5ca301eeb2cd7897f804c142e8ada9feee0b3da685a30714d6279441eaaf37463fff98cf9f4823817052d449a624c0383339134aa0e1cc4a4c2851d16ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b8eec4b10fe48c732cb9b7973712a3f
SHA18471cd6c2bbc67fc42cc837bc179832fb3a35acc
SHA256ee3a93067ba71c55b5cd462d6af15fd798fb0ed4706d572d36dabd8edb49df84
SHA51219eb812bd51bbf9515b0ff8b081539bd9b91aa2063c0db7ac794cf861f0fb0733aca9ee1b7f98ab4ed6e6aaa019aa69290f81e1030a144bf587fe38e60455f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e81dc613933e3b866e8cd22369a3854e
SHA1547ab7e32730501d2116c2780d255885208a650d
SHA2565c9c8a78255306a64bc14da6041d874dd7f95057f704b7d4954364ea177fda4f
SHA5127013a0b567d245f471c66b21b5916d0f9636e21421bc1dd6c4a33b210fc799eb0e9e4d6d31061cb70355fa745f611edc317ed1f0a7f0c66346c4090473350900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e8deede3c4a17fb7abca1fe795b0840
SHA164603f3ceda54ceeb308439ed659d759b058ac0d
SHA2560e374641a20e8a650640806fb2ed856c2798658429173da824cb24920d75b696
SHA51211d878c12137d45a29e656a21e09171811e2849b3b30b56f3426a57e790999debda9003265bcb677b2b8b5e30880979aef68b4934e9d9adcf630d398b0ecd392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a129d11d46632b29b6b8bf1065d4dc50
SHA1ccc871aaa5df2130fad112feaf5f658261fc8dba
SHA25606970223af7e99571f5ff66ee0870bf84542041f05c07fa457db05eacfb518ac
SHA512b9518b3fa443100bd7e066e4431b5dd380e3266876a1cf7da1eeae65db7b3baddf24adeb6c1b8444ea87f922a9c063aef141628cd296874d1d45093348f027ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c91ba0e507eac1e3d5792f37486e87f8
SHA1c95e3152a52dad4daeba95d1caac038b6a685cc8
SHA256b061a76545827be1440f143989c645371c032b8091261f4a46101b1fa7e3744e
SHA5120ce8072f0f2e844b4bc39f54c1b353c47744e2a6df16044997a8af99fd7b5b6be2853110f8b4dea5d1f78368d2588d12436774b7b69a4d56475d8e9b9c9325cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9255024a3ebaf1845dbaae91bdef421
SHA151e020772a4d80de663070f57dc6182bb901daf7
SHA256af56e4b39ebbdc63a9543f023c18dd6b374dab07066c119588a9e22ebeee6c72
SHA512374b5bf77fd21d5c2badc8a63d210e017cf74bb30be704c2d620c9407e07db71b4aaa7fc761a12048e0715fae4a19e6d6c5d56aa118da9bc763e3a7afccb3188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5498a5172d30a9c60ae79cf489d9f18bd
SHA1120cba4d291a6eb3852f0e4fb91810df4882e504
SHA25637e6b9d333c739d46c3fc0e46612f075bf824ef93ee4f9efe4b64327530fb42a
SHA5121a685251dbd01b07ae545f7e4b6d22809330b85ae6deeadb49a5eefe0f91aa483059e1c1fdccee0da91f37c5f054982eef8d9825d07b043087ba7ccf67e9aa48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b574baa7d4f020c664444ab3f5f753f
SHA153dafcfa1af06b3e048d2adde99a14acd8826f38
SHA256a143383cf21e01c696fe3c0ac045c276184becd3c999f3bb050df7f6eb870cfc
SHA512b3cd43e2f8bd0445cc1d6c569f027849d170191f28e3f3ac30b0544d28ce7160a5f6c8d5328e3d2ab1db1d0e726570f0dc363654b4d4a532fe6845d8e760e80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ac8e9d04bcb35fed4db9428063a1382
SHA1b3160e6dd285b9ff6764b1fc6031e0cbbcee35c7
SHA2569e616b8538d1245a9c1ad4cb40244bd630fc72cd888087284d421f7d96739ce4
SHA5124c7550101e5b5a4e399c0f75bf3cdb7162bd9a873ba080b9b5357fb053356f9a4c37b4d1afddcd57b62e736961f59a977b7b510f7d32b4ae7906546861e3c32d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3ed2544d1b5586d43e636352a89abd8
SHA1341005dc2b2e816900d0c4b71b8d79c686a67032
SHA2566c4987a80d86cb8cc852077076b58a3ba2d4b049faf4e289566467c0f9cf69dc
SHA512ec4228043c15dbf6f8afdc2d0119f3f7be1242cb060c1fddb7bf7bc6e36a538c1c83d7a46140f14959ac387cd977c7594d517158f1a678cc787c908e4a95479d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b