Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
8a17edd49444eede91f37d1feb30eba3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8a17edd49444eede91f37d1feb30eba3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8a17edd49444eede91f37d1feb30eba3_JaffaCakes118.html
-
Size
139KB
-
MD5
8a17edd49444eede91f37d1feb30eba3
-
SHA1
5e6b180b11a3a33a0da58b17cd633efece287c0a
-
SHA256
6880cb355fdd182ea6ddcd1b18a55fff82df89a60911b2448708bb8405827752
-
SHA512
7f282fea3e354f805177bd8ceba4730a776088e686a7b433abc8156cdc4f37a50a2be0fd1cca48165d734103abed5e488138b25ced02e2960c4d2e97c655aa49
-
SSDEEP
1536:ScbUkoxlyvjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:ScroubyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43D6D8A1-1FFC-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423397252" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1f4515289d01c4bbcb7249806c741e0000000000200000000001066000000010000200000004c04c97837cd9363093e89de72bcd41f6674b6a12cea09558d223538546ecd65000000000e80000000020000200000002cfb52c285888f2d93ba480804a7f583dfa0927ee15eb18ca520f6325e24c26890000000307f84a225915255526fc07dad570938e1e0b259ead72197cab0df412443de5e71227fb7e3fa2e5b259c4af50da3105d983894b4d142f5478850815eb65ad988fe87a96ea2cc61f0e5ccac38e9f0db2bbf6b40f3f4ce05b5683b6ba04ae0d17e61ddae406868000e5a02718573b9712ec4a26fbcfda7b620447832845255912b4c151a0bfcffc90f346fec1ea952be6d400000004dbdfca65187e0dc0dfb42a2ab7aee17221dedd0d8770b14c5c8029bc866dd44b00eb917c83c29466b20cdb46c4e4d2e33c37549b90b20050568fe468364aa36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0006a5b09b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1f4515289d01c4bbcb7249806c741e000000000020000000000106600000001000020000000b61af5f0ef66736a3d92aa7f0e003d8b7eca5df6ee4b0b601d622607e276e231000000000e80000000020000200000000637537ebf6aafce429df7d05f7a5b19e67a73fb35c1f642eb771a15f7c7db0e200000006ac77052689d4672da8d668f37d013a7512086c293810203ba8d84858e4bb3de40000000bcd4f2a6cd242b75f590250b67b1e63056714f9316fd227de06ac3f0ba412a51e9d866b1b9ec73e7db53d58aec22a90aa2485fd6d0b363a5779356830daea2af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1336 iexplore.exe 1336 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2632 1336 iexplore.exe 28 PID 1336 wrote to memory of 2632 1336 iexplore.exe 28 PID 1336 wrote to memory of 2632 1336 iexplore.exe 28 PID 1336 wrote to memory of 2632 1336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a17edd49444eede91f37d1feb30eba3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ac04ae03888c401b317c1bc6a4fea34
SHA142488e49dc8be898e968dd19912611b748664f32
SHA256094f2c1184095b2c106a36c8fcf9c98f618f979788909787c21584579048114d
SHA512af6b11b8ba7dba2fd6142f2852d165ace8d3d25994856b45793282df3c119826d2b19f0d8b37e70dad2c7a1aad5bb122d423ad1fbb07ec0a8491c0db89605604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0bfe491b63ca7206493f6e1a8750a2e
SHA109383e680393e1bf00d4f63ace60e27af7d26e5c
SHA2564c287e9d127c4fa05778a07c796cb19f072df2389483031c315f84c3a40691f7
SHA512d08cfb03c3a4f7a8c0c552c7f3a285b34da0c27159c1f02a9caac4715942836c13f33bc3373af5aa75bd2c5696790faf5f1d1809b762e4ba66e72dd322d70361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f05f293bc78eec4451b6f42cd907db44
SHA17e79e3bfa562d38a45094433c07a15401802baf2
SHA2562693da876eb5002b1affd064c6caabdfdc061ffb364a3c953e7910c31c8a57f0
SHA5122b0768942e55e2aed7c303d1e4c32a855d4c2063bb89a475db3130db3ba24213ac111dc0699b56fbed753d1b71d953cd11d1aa28b08ca1117675ef9b372d1ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a8b68405d3c23cbbaee8e8b1d7f3a68
SHA1eb60e8eda0a005e8a7a454ec0c662d9561fca690
SHA256e4cb0cea162c3c96963535c1df1292f08722eeb07de8f77a8fcb98b66549eb85
SHA512b3009f240c0616e446cd9d29f303f3f248146c66bcc7c450123bf63e8f6511ab00b48cae72a765139050dcc6ff3d75dd0ab23d020b6092013e4af18a222db238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58247169f0a9927a9dc455b51ea01a52c
SHA11fc12224c35b953cdd4b1164192e61b27361f618
SHA2563ff125ca855872b66b3907179a10106eb67dc19768b80530c7fcabc56be5aae2
SHA512d940d0e080acfc5776a77c02d6d1cf4ff2465c5682b75cd8eed776862e455c23fa855b29d9bda8d3b15e7444fa3d875ec4cc416afcde7b9fbbfdf63c98a7ff70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500b7d0984b7a63073e8695cc09b2aea9
SHA11e747c1040f2624788b25e6d1dceee017999866a
SHA25605d523f06ce5ed38809c3cf14856fd647c14c7ecff104637ab8c3b0470e2c7cd
SHA512e1135e648f16dc5200b7373f68f512d0ce552fcd8aa47eb5e1891c1203ffc865ba69fbe6f651ff1de8d2ad4095a171b76614999a7199d25d803b6436a504bde2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b7d6979c61a42f32c2db19eafcb3319
SHA12eeeb135569d9fbc70640d9aa111b89006f92794
SHA256dfa737336d8554417dd30318c43fc44d53e894a74780f6192ded3c56b390890f
SHA512bd3a135acae6e810141c6eac0b65433594a0417bcb9ab622d01efe082217d16f0996cedad9e1866b18f4bcdf83e2789b8141822252791a807c89ff009a1397a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ec0192cf3396148de80062e36ca402f
SHA15beb903029b7b9faca3db050d2f37be0c7b1f510
SHA2568787eda9847a3a133cda80af293f26cf86de7409fac88f592433c02bd6925203
SHA5123cad05eff2e9f563293b3d8fd68a6591d11219e1bb207681205ac9fcde401275a2c3f7422c3dcec4767c165d20434e408a7db10b033114667c7b525f2531500c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a77be75007ded328922d0102c906413
SHA1b8c47f310193407fb18e9eb4ac8c562044892b74
SHA256d39466cff91674dcb64bd5314b583655bd96800a6605d4f8cf8c3b5cf86bb896
SHA5127c5fac4d951d1041f898668c7b402c7708c628369c82d87351ef91e07d7ca01867b6829d71e2283800e1e4df88c958a51045406947633837288e14da2236fe5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b0d52c558a1ea02a313163179b9991d
SHA174679ba8be20028ac84860b5072022e5b1cdfc2b
SHA256039c3946a7a59b76970407c467bc10e6955ea28dcb7abfd196ee95974cbd26dc
SHA51294846e404d4319c64c32822feaab8807490cf892a17b82161f625fa2463a1fd4dd1135d9688465ba3acc89201c20e34e2601ac41e2f9a090e1464fa5481cbccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9e132ae3dd4b81e2bdd13e25efad138
SHA1ba97b1ecee4ca2ffa7d9fed66ef344133e8f917c
SHA2564489530cf165df48a6019850f4eb625ca4fe5a5be31928195184319d1a201877
SHA512eadec1576093cae8b88ebb0bac511e57711994d668595e167411fad4bda33ff7c516fbb6d8c9bd979a9aec32faca1753ce849ec6f574790adc9f134c5c84182b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8f48fe66ba38d25560a6c6b10903de2
SHA10600aafd644213b233cb845c1e8432e38ecb57d9
SHA25642dc33bf9766e68890d8b01b35876427bf8e071654ca3967f73405ecc21cbc73
SHA51213005d25562794928028dcbeec8fcded4bcb752e634ed0176e830c0465b4bf573c8b3a5a0bb8e17312ba7e530815a3fef07e1eda7b7c3988a358e4b9f6ef9f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599f4cbe7ac2dea925cf714782d1237fe
SHA13fc235ac78211cf45e2acb5a2b3ca269f5b3b763
SHA256c37cc0255d84bb0ca8822011c4ac1e3f15f1afe9ee5f073c91a1af878761ac65
SHA5127f141da4042ba0165f0d734078181731e5947dced120553d33d2caad6190054242292afbac1a5d905776b794f18f12b45b7b1361373f1f710833bd0766bc4c0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5323048b35e4497bb3d1d6a363844bad6
SHA121ea16fb99007892772da75d387fe8246ac17846
SHA2568e157acb790ff66a03751a4700a9b011fedfce740ac45748b687795658f7afc7
SHA512c0cec42925e01e01a0e71afe39b23f7d3699697470a7d6f1560752c2f646cdd4bfccdd64967d2090af9df32ca436e14c69287c3323669c2f00f953142c06f1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3fdbac6335d3ae85501410ab18abdd0
SHA184e4e5e1be5b0d956eca211a982f8faf560e144d
SHA2561ff9767bd571c453b5411049f8682dcf05a7be56440f82bae232aece6155329a
SHA5121ddb7bfcbe68b4c8eff62400db5b7af6b0d3ddac68013b67559119a6737a98da97430bc2e622f970f889a4a3613db691c687abcbc63085d19c255bc9cec44176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d328ab3a44820bd3c4a9fd175b9036f2
SHA1814c7456fa8948c11a8a7770219b6a90e48acf9a
SHA256898ec463caa76a5e0d285e89932ae1b52f699ea1ce5f2ca6713c4a75deb93c93
SHA5122c41278cf3f8223201886a162d72d25f309d6c6a8fd2971b2ff52535c196dd51b2b36f743ad4bae56e909619407065c3c3e097d031bfc8edd3f7502e77ca9142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5050c06586a51f2a59295d7f107b76996
SHA16f8972b4150f300b2d61e4243315dd881db48dc4
SHA2564218c2deb863ef7dbc7c87efda460d94860f7b24d4e4f7f2a80f5810819173db
SHA512045265758ee4832a70bce519ab9f1475efcac80e0a9c2d912e7ea1f2dbd345e7370f9f9a8add94251f6ccb7856831d25ab9794e32a9fdabfdde8ce40bc17fb0c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b