Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
8950fff0c18781729eb4242c97ae3e77_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8950fff0c18781729eb4242c97ae3e77_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8950fff0c18781729eb4242c97ae3e77_JaffaCakes118.html
-
Size
3KB
-
MD5
8950fff0c18781729eb4242c97ae3e77
-
SHA1
ac514159b9b0d014cef61c70b68e40eec723c021
-
SHA256
8fa3473da09b529319918e64c35788a7c24f04c165a493e92ac06c050ddaae70
-
SHA512
43e19fa3e011cc575cf7f36fcf7e37550f1881318df5b5e1bc65f1a47ca406c2f39f0feebddd6e15bfa68175e448e76be01f5ea3e8b3f7babe313c8f74a4cb3d
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000041fca3b48a893b498e8e0ac1dad63ae800000000020000000000106600000001000020000000242b3a072d410fd8a442303736a801c9d711f56b06084de5775a9cc684011c9f000000000e8000000002000020000000ed9e61e9457673d4042172f4ea68548db9f25bf51c2b33898eaacdd59798040c20000000a316e583ec1a1f4011aeabde60430cf67b8c9ad9cc40ae9afb5bbf4a9d791e9b40000000ab94e383c7a1e1915af5f5096aa3e95a200a1cc0bb0a4764ffde196baa9213314dacd98eb2d904bb42f322c4a3b8e807cee7ec131a26e7dc53812531b742f346 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A5B3ED1-1FCC-11EF-B20D-42D1C15895C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90aacc20d9b3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000041fca3b48a893b498e8e0ac1dad63ae8000000000200000000001066000000010000200000005e095944bf299011c44eb17bda3649ed33c41cd67627044799ca2a8de6c460e6000000000e8000000002000020000000263b7d48a50771fa0f1e0e5b23ca268380b8e7f241e9e228d380fabd691edc75900000009f0784261c945a9f92f907989d98547be0c3593f8bdbc2d9eddb8872ff73b0da3c6193fa7248b357e27f089a138f4054badbe1d67443d10c068b8bc850c248d68a75aad22bbeae869b98e863a631fdcb7bd5553a0bb04d1444733ac41d542c0576f53bfa87fdb37f255e90ef4aca408aaf79c56e2ad2e885fe09e76c22a2cf7b7113e9f98e715865ac32d29eeefde89640000000e9aaee4be79064955ac518f66be566a0ad058d23ee3603c2d73208b9c2729b63b5969d194827e11db2f5f9a899777929ddaa2ca0b53d96f985e1e6e745c8079d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423376642" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8950fff0c18781729eb4242c97ae3e77_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529d727a1a5e85d7914bdc4de9f8abdcd
SHA1bd24aabb8019ee790448b0b20f5b020aaee6034b
SHA256222a96abb4042a6e6f05b87d1bcc3e6e971814428eefcbf0565e7ccaaab869a5
SHA512be238b2bf862d0440f2e42fa7140a77f65103fbcd111d9e98d3374559ba0007d8bc4af23b7dd76aa8133e69abfd4bc97de5f385f5768515f1f939b5882ade8ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7074bab179aa8bd077e4ffacf43bcc2
SHA139c3574abf07c93308b7c55c16619ca9d62536fd
SHA25629d232b3a6db57aa02f3b1ce1d66f6d85fa5ee96c91e1dc1e370a1f0283d2af4
SHA5129ebcc5991bd5ec90a33f3fe3fb3c5196d1cec62b5624925f7e2e3066fde285ace95268019989d604b8511d13c112cbc0647245982e1b681173d56ca3c0582f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576c582ba12d337ae6f6f5c7ce88052e9
SHA13c917123936154faac28a2e45f720905ce1f002c
SHA2562487d30833dbd00fa3918dc9e93e268993f26978b21c32040625d9c880fad8ce
SHA51240226a11c747feba6ef27a3d7c6dfc9f0971f032c6266473cebfca57e6756fddcf295c6c0ed067abef2c27cdfbad6687b3cf81ad9ca5a8a971ae7b7fdfc4e873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542b8bfa6b96d8681ef57e5cf5c18e9ed
SHA1cda0b52c61108f9a247062a4a3ea0d184dc2bc44
SHA256156bd0cf6728414df6e7621ccb8b39d8717fa6fbed30b9e5ccc0760425e814b5
SHA512a44608f12122a23521d40bf58e48a7805a21b007cd303a6cd1b8f7bb9596e8fb6d045a5ed417d4371a88747e716199b7713bef1ae9e8916512f3d29f28457e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea81bcd19926441ac7ed2c0d7e86a2ad
SHA1a4d7141577279c9d5c1eb0808da660e2aeafa9c4
SHA256bda0ca76a3cd4ad5e107daec93a8ec7a4f684bf9a2c96fe0744bdac57220ea00
SHA51290b88cb43488f6577de48040b5c4c0ceca38acc3c033e06b40fe95c30a037348df0d09963b7de76943ab601a52263e845aa07a3f12e9f426112d3bd05d49e214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bde0629c06b50a0c51057a6212c65429
SHA148bd7e52fdf23fc4a57b134c2d8bcd46adde1861
SHA2564c30ff55856ca4e90de67b8c9e2a3200efa1821bd62cc9f5b61c653aeb1179dd
SHA512f786e2eca37ff28fd51976d2632899ad59deb960d03efb21935527b05504ec1d68a357b699177328e8b4e3beaf56581845f91970fbc0168e4b72d5791d3c3a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5400d098dca2686554baffab285cca5eb
SHA12f30ca2547254d29b068d5f0df02eea899ce3110
SHA2565aa54985c12f65bf8d94795e1fdc9f90d1c9029032d370b22c622cb00bd316ae
SHA5125968d7d566ec94784cb00c6723baac95466529de260082d60246e8fd183d321884b5a2d845bb7b7da8b6a8c080cfa3698159cea89d6c01bfc15ca7501232d85b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c8a44ae5b77011597ed8e1deb47eb76
SHA1413d405a3bffd0c1b528d5838ac4b59486cf5f95
SHA2563cc1d374b8165e034c07249e15082b6dac96d1fe669ec13a86354ab56a070ffc
SHA512c094afd2a1b8fb8f59ed901fed5c0112718774456442b942648fbcbcba60a6f351a8aed189a090ef94c505dee2bcc44d2bcf78297dc8c86c4daa827f972ed0bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524e96bf92318f3768d8920434d7c9be5
SHA1b59760a15f685dfefdc8b9db343f7918d85cf767
SHA256579df465d289c3a8f97ae4ba59cbee8c17905ca4e5c188e516e59a73f0cd2e80
SHA512f158a1d58618e640077c1094fe47e77c33226adca3645a7dcd3074a903a136b5fa3c628a2faa7cf1f0bca423a1bb133ec92b846d934aa866183e1c57e82fa95e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559993240c3a804d0707f7b0c57f0435f
SHA1ce6483d9c0cf902d170e316d4e2fd234a4bbbce7
SHA256bf02bd6b457da85501d92a09ea3ea3c60eb029a4947f3795d84d9e6ed6a467e0
SHA512f31ee653faf7eb7f6f034961484f9a51ae3d9aca0232bdf4a643a8dfa2e9ea9ff94bd4e3c0cc2397a4b4fc9c7a0eb2debcd53385e97cc40e690f236c1bd8fd5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58904b2cdb0e74be903ff8b8c1133a40f
SHA13a228ea473d683cb3a8cbf9a167bfd4470f66860
SHA256664c42288177ae7903f0fc064a54ca0a9e339201b6842a02592ed91e67b52fe4
SHA51296ce3fd473c16bc4f892fa56990387d27e2adf8c9796366a0f4392b6dd6d1fb98afe405b4305ef4e33ce699f7f251037ce1d41809b4ef5212beed45d448a0afd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528a797ef423625137c66aded6a1a8f45
SHA12acb4991d53139f87f630faa194e58c052ccd560
SHA256b77433a057b5fa7a55f73780375c829eba95be16c2e4243b9c0de3f21224b34a
SHA5123790f94f8ea2f885a0c50266b4a4437b3a78969f6e256e20f034936c6c33bc32b5ee80a09a4a1cbcd14391f89aad43a29394e245b2daf0aa500598d78a75e7fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5441b1eae3d4ae0200d86877c8d974467
SHA120f6e39fe2790ecf1090347eed96c249b6fc80c5
SHA2561e9de15056e6edc056d067a6ea01b24799637114e38eb3375f97ebc817b7a6ed
SHA512e84794afe40d405cdc47ead7b54303b20698a4880095e3832739f4bb47b6a6e274598410c46d244424b6f28dd1eb499d8412a848f24a2ed05efa350121b352ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5856922b40956dcb85a8ba582e92f9b5d
SHA1ade2edb29700ed9b604c9e37345377f1a72358bd
SHA2563ccd222e5e2e59ab33e97743b48c65da38e0d9e565fcf473bf849e89db42ed9d
SHA5122347c1b2133b0f38d7ca9ab752f667a111ea4768e032eb09466225841edb24a36952d1080054a2d907f0557599182d6f1c85b85e9d6a2a1b412b6ce34016882d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d22ebcb69f02655895106e036f9392b7
SHA1c997f9632c7fba4389f4443d59c0de6df2f34670
SHA25685c0a91c3a2b833360d4062c33d1be05b24ced3764573269e7cdd766c507bf02
SHA512362495942eb4008c3f289dd0fe9e5c533925d5e0ed292028375ebb2301ebe894be6bf7dcb04966dc774b3856b8d592705b489f9715cd810c63e256418edffe1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce0ccf98c72e607e0e050efe1c747771
SHA115c7b00bec1c22249eef97eefcf9712886470cb9
SHA25633fb55cd5f64c0c7a3e21e55ebae2ae36cd51f966d3d57d64ecfdfb736987767
SHA5121ae50979a49076fcbb5d30802c08e2bce9edccc905acd1534f5cd1e7405f5a585b22538bbc9ca67f2d8cbdbf665b0debace95fbf78e179f1d9069d4e82a731a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4bcfe63f3c255bff32b76434b59a3ac
SHA1a8ecf48f5c4451c934ce1b8fa03f3adad43b04ad
SHA2567116e4a6a06d3f0cb05fa683ba4d74867ff37626e37032707a78a4de9bb9606e
SHA512a86827b74e8063d633c8dcdffc0c70700d8483e26d41cbd61a4faad250ce8dade02e1d212e4cba2d6033a33dc0880850caddad8c82a0fe02aaea39a9e33e3923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a631dc353dd3eb0ef244c1df112d6b68
SHA11650409f4835aa97dcd8cdea812f2bb8e25efef7
SHA25623d0737b232d8c367287d2514a2a9799a7249aa08c434487d3c5e94c2798bc23
SHA512e8430c6ee7bc9bfb1eaefcf2013efc045189e5c3f04eaaaa140777bb1d67be6c30786a129dc8d6b0846d8522607511a7e8d152f62052625b199254c397ae9dd2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b