Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html
-
Size
19KB
-
MD5
86fd6407360a38815f0d45b5d3f2bfdb
-
SHA1
9ce01dbf2995a39d4b45e5368d144f4fd1b1cdcd
-
SHA256
43f4e417fbe1023edfd80406342285a20dc361b6521246d590bf04e76e24ebd7
-
SHA512
a12f6097020fa531f3fe62f7b155b7a7e0141b44cfe1e7c9995c47f9328b0b20047bc4499ac44bdd2b1781e6639bbd66b8a36cbe11c2ac4b54f74e62c82131ea
-
SSDEEP
384:DVmF6rXKXqanjCiIbzhki39eihzU+Wk3O7WVXmGJG1mjNACjL9Zyr6eGmAxhyr6R:Hr6aanjEki39eihwLkJ61mjNBVZo4ob2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a6ad14faeba852a8fa174832752e359c40932608b53dd2ac16ba2851e154542000000000e8000000002000020000000bc7d3d75259ba57fd933f342e05f2a79bb1c025dae839c7fab109b9c6cc7f92520000000a840f5015edd9494c66a13a0ef4bf827832f223e5b056dbcadd9d8370a7ef944400000009318bc771deb30e79aea73de7f6f6077ac6f470df1de46bc604153ee3b2a3f352d93ccd3d462486ac1ac7d641c035b5df9d58d299221ad6a5ba72ab11857af53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96612D01-1F48-11EF-BBEC-C662D38FA52F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000013a8643ac6b4b4f24b5e0bcb981bcd71db19d4b3372cc2b781655c56cb3a703c000000000e8000000002000020000000f4ae1a9e53db604c8ea1ae8dcfc64643fc8d4cfff5d6344115a0cffea5734a67900000008258381776749853578481c7133581059b014cef8b023e3c778775fb8b4ed637c73dbd0bc47acdff976dd162b09ed3a791139b910174f2e1a26714267d8649d77de1d66472da5ca6b606c8a6818027f820eedafac8f6516a9fe6f39185c9efe4229f872fa70a37746c208fdb804f87b819fdd2bac008809ffe7cf4942853bb798347a811c2c53661cdacbaa9c7e28f014000000044cc31e8211667134ca1dcba416e4a10c16152b958fd0ab654c13ef51c8eef528e81bd6bb02c67a889429b0957e8865965a678c8c0c0bc728df9689ebf7bd815 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d8e36a55b3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423320077" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2136 iexplore.exe 2136 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1296 2136 iexplore.exe 28 PID 2136 wrote to memory of 1296 2136 iexplore.exe 28 PID 2136 wrote to memory of 1296 2136 iexplore.exe 28 PID 2136 wrote to memory of 1296 2136 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f504aacbad70a05d9662fd45570bedb
SHA14b35df10259ce383cf8924fe39c5817f54247dd0
SHA256e0f7e301dd1ae1fb2133d9899b5a532615121edfe34f38adfd6f7ab909c2a104
SHA512b062952908e3548bfa3c2e97a7fa9720bba3ff482272a408c3b474816ff2b233978f04d773ce8afc0110f86dd6dfc40822c520cfe196ad1c7e34632b6fd3cf34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bc26c2c1ecb48d0fe8dc68dfd097537
SHA14a4c53f64325a71bce6759a241694ae693b95b42
SHA256370c9e5d109e49b6a577a9a4afbe8b41c9cd392a7799ca89a8edc441a621ef70
SHA512113fcb0b4e62f8e8cad4947a3cc4e5e9c4158b75d18e0e0595815097e90ff937939446698108f3e7e0c31b0e6aa47cf4da793f1ec17c8f5ec68543e1f04b4520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a958f8a761a3d68f98166c2ab542f5c9
SHA14f2d67bd8a239334aab5fcbad8bc3a3df6b34b44
SHA25604036d92af3bff4d34ce95cdeb414080efa4a14b0f48d2e36e1352ff9eea4ba0
SHA512fa4ee64834369bd1db7cf234673ada0e0551eaaeaf016fa8496d4a6dc01c31054173b89eb38c29ba5055a7a562cadbd18f7048972341d600d9a12aa13023cdbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5069b7603c236ce6b0d2632fb630eebd8
SHA19794a1ef99f2c2aa646a9754da1a87b4a62e4f5b
SHA2565dc573d5878ad38b20e735c2b6c3b3cd0ac28616413011e820b20f7decd28527
SHA51226935a87f970bd3823dd2d5d8ff6d345c3d4a8d61a25832cfe496a1c044d6c37821fe9888c6c133e9dd1951ffdb2eb240709b8e3277f8baecad4b93bb02a142e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b023f6a6a2584b551daa84f819cb129e
SHA1030a471627f593375a59f923ab8810a324460d81
SHA256e73f6ba5e36d6bd30acf8b195f1b91291187d3846d92e71aedbe563a6e8c9904
SHA5128e2e10e5ffe983a7985e0893d1927e38740b39d36610fb49e74b6e6ae12822bf76c7571628229c9377f5d875ff85ccac3e2e3f5ca8f77097b465d0def095bfe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532597fd583961b0adfdf176fc0e3d4ed
SHA1bd85020a043f6c174428a6d131c16f826d1ff379
SHA256615b902a0a3f989dfe03db24a7d2df37432c23e482c732f8ffc461b0cd5e89fd
SHA512e6f0eaf4a970240f0a7c6a6b620404a784c7c29ab278ac91af39e1cf0bfc201ae80b8f154321ca2f1f1433fa98d2263fb2ef6a7ade2e3955ec5381ddac953efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e5348d377ce70f93846c523fa56e818
SHA1deb7b6f29cfdf0b5198251213cb6e0948c7a928f
SHA256dba26ac7676b76d95ab4bf887b7a9dc872feabf9c52f339e3b0a2187d2484565
SHA5128508ee9dcc69c6e966e668c64d0f6ccc9b6808ed2d2d494f21309a0060075009451448d2e7754df25887a85ede3065cfd5c3fad29adff9e6170e37ad1de7ddf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5059bfc2d413e362f2a703a875279d4bd
SHA1e06464554efe2e4fb45ceaf5385cccd116cbad36
SHA2568e5cbd002f022e3fe9563f6288a765d37ca97cf12e7dee986fbd4646d9d22a13
SHA512eb2938a4b621a07a60cc6337d954f851c16610af57b20b7c927d80b4ed2e681acb34560099e275856baf857db03ad1d7742ed8b21bd45a62b8afd8709966b04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bcb608feb9d1ec4f6ea1f166763b474
SHA1e5db7b9ddbdcc5fa229356b164dfd95470b6b1f7
SHA256c3e5820845cb78ce4a68c5ea52ec310513fe91a08f0e285cfff8ac1fab3fe091
SHA5126a1618199b2e97f327b9d8d483657b899f8c97ccd6e213ebb0a6f8f4d33791d2a041fd015bd60bec6dc85718d259718af41c6768c88c8f4bd4260accb277234e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592215900b53a5ef03d41a1ed265248b8
SHA17471290c8c0bee149686483b4057fb9eec3110f5
SHA256ee4a07d24d5fed67c0a77eaba98ebf8ce19d73eeb9ea63477328c0c1633ba1b7
SHA512606767c4dff74666264d0a266f3126ecf77f25f3f06c35d2c9b2ef2e50fdd5409eed53102138ee8787ec01b9abcea851fdae15f21aa0e5f24a5806afdff7c32e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c506cb676cc57fb2a07e11a825fc5f
SHA1bf4ee0d8f29b13473b5871fc9911a9cb24f87d0a
SHA256c5f0f8eff96e66a6600f263fdab0215c5741247ffdb3f059cb02addf1e0044a0
SHA512fd1d6fe4c86e3e201686c9699823bce95af718783f9e0c8f0d1ba17fdde3fd25bf234b1d834617cfe6eda99b685c9f99ee731d2e799a610296271cb611bbe97e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e022ddaaad603483c81326f866fa133
SHA10b7fad03f5195d537b34f4f80b734ddb352f0d7c
SHA2561fd1ad60048f36be91e6b1b90af059de9ce2169f763781f6a71714cd759e2d41
SHA512a3c68af9ca3c2ee989bcdf33d74401ccb5591bcd947f2c6c53ddfbe3fbccd3044e2745a061cdabfbc53917142f2c2496b6be7dccafc7b40cc3e5a85de3102576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f6cbd6f5baeda2e13e1fa318086351a
SHA1c84c9de4930cb5a497ada927dfa408b5d743678b
SHA25631d05ea67b69a1e402cdd3b9c3a849ab7892648b6c73ae715136454fd346877b
SHA512a8614962030a20057a06c6d20598e7320bfd2fa13a94901dfdbe7400e8e6486bb1ac92c8fd1d8c70897930a93f7a398af9d9f4a9f5e26c3857861e63602a7bee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5801d9d381d96e5525ad222fb3503dda6
SHA1f976624c8f92139858668ca730b95635df533ba6
SHA256993cda73ed4cce934e496dcf7ef7becaf9d9e7bc3fdbb45c1d5534f8eb670d65
SHA512bb507a85fedc7b8585d0964c091ad67f61b4309b14a6343431c64685c51b22bfacb0e942eaffdf1fd279a76c3095196b53842404e182617361e6423ba0d9ffe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca8b7233e771480473cc5c715d2f5363
SHA1ea31e02285bf6dd84c433fe529760b29ca9f1ba1
SHA256e5fe3b0507f12d6b150f510b4729e4517febd248346bfff9bcc58a13283d9031
SHA51209d2e731871fc92e3615bdcfca7794fa36ede5aff3610d0092ccf70a874d30b4fdf2c8349f4f28e0692cc05e9672e1666dfe8cb9babc3b108689d99ebda7edec
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b