Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
8a725110dcf587e15f8bed2ddc8665ef_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8a725110dcf587e15f8bed2ddc8665ef_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8a725110dcf587e15f8bed2ddc8665ef_JaffaCakes118.html
-
Size
10KB
-
MD5
8a725110dcf587e15f8bed2ddc8665ef
-
SHA1
66f26d8d68d0c018c3a44f47c599995fec2e43e4
-
SHA256
3b963d4f7baffb43e87a3e6020ae845aba19738d8318d1e9d435f95949600288
-
SHA512
360df35d262edd4994e66b3dce015e96531fc7870ea7973cf88ce1ceec2f1bb1f9427a0f68078bf7238b5c92b9351abee45508256ca855f46a56e3125a0fcbc9
-
SSDEEP
192:nl7vFZ7vKIRaNJQLB5Xhp3SjB0psloxuV3uO7zrKTVW1n7f:5fCIRaNJQdbpiNgsloUgOzVn7f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2044b9f31cb4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000088334b0e379e722d1381fb702107f7bf884a14a4f59d063c3d4aaee88b00d59f000000000e8000000002000020000000ac3927d2c5599e653a07b52c334b637123a00e9333075da8116e7006a5f9019d200000006ce8d6dc58fa5df5d2cb359712245e89528bd4ccacf160ca6ed644a96e4c8ed940000000805eb67025dd9a0d54aa9d7047d4de1714b0e584ea69d5bd9e48a2e402ce7340a1efe3ea4b8df462c85676a689c11bb17265ba4de8443b24916ec68caf462fe0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000003a9d839b46150e6b4dfe1ccc6b4ed0ff5245ef352f9bef157162d4495cd34cd000000000e800000000200002000000049672ee50890d19a288a92e6d4d556f37af5bdae57ee87c1ad28801ebdb93d5c900000009912b712b593aa1a5a0c70c103b062c576f72218b828e32b7706d1b3e25c72e929284fc91c896c965f7fae0859d09218a16fbb1e5aca917f151c8d4cb73c3e58f0b37d5e8295a17237a07a084645d0df260eb610d2757975a9c92df0dc5d7483db489d04b435febc3f5041c2885a45fbc1ac6e30caf8f190468fa77090c6eb02f79103543f0077320442c898cf979d2d400000000397bd4e719df93cfe8615fe1c894d671193ea25611286efb8841729d55e9d6d7603da0d2eb9fd27a6b0a1a501f09456a21832b9529826b50f7653c7765488b0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423405805" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{304E5421-2010-11EF-9B88-D6B84878A518} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2064 2296 iexplore.exe 28 PID 2296 wrote to memory of 2064 2296 iexplore.exe 28 PID 2296 wrote to memory of 2064 2296 iexplore.exe 28 PID 2296 wrote to memory of 2064 2296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a725110dcf587e15f8bed2ddc8665ef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ecfb8030281caba5d0ce9c2e62beba7
SHA1788d4f9c838e54bb4d3d7212bc5d2582b4ea9446
SHA256dbb81809c1cbc0e5a8d4b803a6ed7dc0408f088ee45cb4d16eef6b7e92db56c6
SHA51284a3a2bee28ad3c735c3d8b1858e9554d6d58b85a7cf0429b4c24d3d3ca13eeeeedd328b45373a674edbfbd523556c1986fc3838f765ee6588753130e37113b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca1611a7442825f490808d36308fe234
SHA19f090a8a6a924946d76379681c5f2acfbaa8cfc2
SHA25629c12ab209120c55c5a233848055c90f7b756e77cf1424ddc2c6af5d1888cc4c
SHA512a48b6dfe78751abb8d4e0476cbb44acb3162a34e703edffc5d29cf984ee30bf7d4cb1f74bd7c7026f3807fa551a7d6395cb1813fc0e3c165a55e7b4134571c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac05f4a0d8f05c734c3949457256cbe
SHA1dcc256b341a01a431f988d40ea9e2a3b2b3334f2
SHA2568917047ce99d3319db8da3a814b3f7f8a3f0d586c9f19e9d74a325c8b1e7fff1
SHA512ba1370a65a7e225bff787fab41b8ad0f2589073d0fa6f7ba137ad9e2915097f4219c3ccb405b20ffc8f204981e8ea46030d6b27e4c71dda7202f1964b3f13e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b419d087d90d381e230fc8ec89d23f7f
SHA15184bae709d1b63c144a01cdb4b81e8ba348358b
SHA256f4235e3d01e6afe25c05ec3ff37360d3ce0c694f4f9df20e7dbc0e5a9b0f885e
SHA51283d9925f24afb4434ee152ed994f3a60e7349077e8633d6516da0f2ec69e1142fc7af688a43ce068f080dfcb91bfb371ebf73f66a274f63f3380720f6f320687
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ec635f3a2dd01c7c73efa1fc4812814
SHA1817565365c2259f5eb9c36c34b75aef174a59021
SHA2567b3b3158df4d7d2e8d0c62f14bbb54e71147f82adfc6f507e7534af4d15f5d82
SHA512e0804d41e22e1043491d617e8338983d1b6ca44c4cd0c55905c5a14991607a554e3b775cae6c0587e9a36da5d41dee521930a69d6fe7e299c8bb263cff84ef75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575b869fb5e6673eccd6945be1a208a01
SHA11a7e6a047673fdca2fff029cf1f21588c48163b5
SHA256b1cd4015cb381dd04159f58edec553b2f9c8d9f62afd3944dd6a5dc970f271ad
SHA5125396284b32bb92002148cffbedca4855f0dea381f167ab73994d2de8ab318c578ff29444c0c9708302aa70e9b8c2bc5bff95a65be2c141ef911075d1432f4c8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555891dc4414ee2a2cbbce4b76e520488
SHA1839d49010dc5bbc6deee9f6845b95d4628fcd656
SHA256b9bf49c610df597ff40eba1d41ee0334c5b0b0fa17681965e457c6120bea5185
SHA51245b09e2e69083ee4097268692474c741e287278b7a4942d198643a115cf930549cd460ca8b5420e8876fcd14e7e46200851559b197e93f70ba75f140c4294fc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f06bb3de5932c21fad9d01fb90787e0d
SHA102dc738bdd1a1b46bd29dbc422c5d39cebdca968
SHA256a7977676b3c1d0b134a63a9fde07a7cb763b3d692e981cbd1c4e1c4c9e198fcc
SHA51240f5f0833f9bc5b8334e4e3ccd2650d2d26cda3d17cc5008828217c34f14fc1d19f9a53d996a2ac48e75eaa338e9ec110f6c9f9640887d0bf8d46c1691f72b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5485c3c4d6af04e094a79a3d7c363ff3f
SHA1847b9c52bd1c352333a1efaaac5664b877b3898f
SHA25661c41f73cbd9b309b0101f5761687eac34a4fd91397ad9db1a14f576a476b6ee
SHA512ba97c2c0bd9a788fdff9f2ccebca22504063019d290b2a93f9a04cd1d7a6a8a5e519f7ae204e83c81f36fb4c19919c8a9946041db07ac3e901ee315bb1ef24f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fec3fd3e36979f251e9c2fa8669dd262
SHA1915904781623f99b446d97bb15c70859fd4c8aa0
SHA2562030a29c8929d190c9a457ea43879690eb7d823f2d21a79d6ec34b25ed97e5e8
SHA51224f642565852222d064ea5dce814fce2154b2c4a184dbafa17a8270f5967a4b418c8767a4046d466e6f01148b263af25fdc5401b33d1c2098f5e982347400ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562e879bbe614864ed7b1eee3b76cdd4b
SHA1535735e7e138aa4769b8b7b3653391a0a5714540
SHA256c1d4cd3db6682c80ba0155cd43f52ed2e86f8501e1ddde307467b71d9440e4ef
SHA51257e57826cab8c1a83c74d9530a6c300e6fdad3a0c9299f3fa26886f0773053eed4eb29b62ad0bf3854bf139a7f8af20a1de7296b8657b2439887749151b760a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546886943976d91535ed3f352280fd60f
SHA1565422be429ca1b4806d86d05a43835a98fbeb0a
SHA25607c21cdef6a11613d9afc85c6bfff557c018658b8934ce4c88b6e12c62848766
SHA512a949a5aea5575c99fb1dccf4e0425fcffe4732d036fdf9cfaf38d672a77d65d59265cb9101e16d48088067825b015ce3a075635cb5a817176331f70398eaa0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51806733fd559cd3f3775300629888f13
SHA13a4141959f70133ed30bbd4f4c75e849eeb07309
SHA256596117763215633e743e1fb582c81134b6980d197f1c5293e6be0b73cf89021b
SHA5127de73f8912d99d3962e810c4d177401ad8857090cd23ab51d43a414789671b23ddabe6437725da081c6e0566f87db7fb8d19f9556f51cc8e81984be10e1f6c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5190a63ee35fbd4d86b3736a70fe2f72c
SHA1f1ec5cfb51a26179699009a580340e7906f0cfa1
SHA256d4984bee1f1948b2b551b680094e164e0ce150c23c237fae7fab1b91c8b07805
SHA512c921770b744d8fd1cfb0c47bf8589074d6d5a715cefdc2dcc9c40a1c057f99ec2cdc44a23dd17267ff43c458b58f64160d216c7d05d55a9580111e7f64617673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57826ee60f756166d1aaa565909803b5c
SHA1a19e7c610051218db24f3d33879e93628dc2bbfa
SHA2565a6850389e1d2820d6bd949c0d2e84e9cdc3947051e88823331be2a14b4751b6
SHA5122e318f7ec7d56cb0275263588ce093079b2dad523112de31559807e7a53619fe6cae07a922d8d5b7b70f9e85a6bb47c3e624201f50315d60ecabba7d60b5bb0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5813a6b98a3fdeff20ed556c8a7309616
SHA18aee6dea3b638154632d822d9d6a84cde50198f9
SHA256c50ad23c6b96c4cc56754937720a2acfff5a3ac37fd75079e06a95d9bb1c8840
SHA512d253616ec5194dcfc7b2fb6b19097e3d5937cc2b1bf1095130f976b5df58e8daef8aa804e8dd943f9dfa4254abe6a701348154422aff01cb579c1d72cf1f4550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580591309e802a19ccb8040165059d2cb
SHA1ead174d5c9e0b96b3427f59b98a8c97d5f07df56
SHA256048ff61feba7098a785fa9f86439b09b5b22806a81f20ba9cdcaab750e04989b
SHA512d654ef7c4293b41664011a9803a61485d5e3ccd552f8c12d6327397088421331d08fa18d77426f6724d3f76095871fa5a40e5425e99cbfd58bf72a6c6b39a1fe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\favicon[1].htm
Filesize20B
MD5da4a82cbef9e601d7ace23faf6b66e96
SHA107e54a312036f96e1fbfcc08a3654148e1404b36
SHA256af326f9224e3019abdc3893743675c69a114360e37c6411da1524860d5a84f43
SHA5124ee93fa2dba17d815c5bc9c4073f7b8aed1e6df0767297908cda8edeb5309e68c8cfd4a9ddba650db0ba94839c534b01fce32bc64b9538b6fc258da7c686c647
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b