Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
8b5aafed6db891b3d9cdccad63598686_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8b5aafed6db891b3d9cdccad63598686_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8b5aafed6db891b3d9cdccad63598686_JaffaCakes118.html
-
Size
461KB
-
MD5
8b5aafed6db891b3d9cdccad63598686
-
SHA1
d1817a3db87c2bb4f1a6ca6fcc59c0bb63478bbc
-
SHA256
e406d75ea4100d4541f90369d12d4295c8a3cff67e886197d25e052c2bfa0cd0
-
SHA512
7a9c8498335110af652bcfefd9e975ca098879f45d5347c2faada9b2ceb29e4f39da800035e8fba076f4bfe8cd52c492f49295ed9927891fbb708e9c38f3a8cc
-
SSDEEP
6144:SnsMYod+X3oI+YMsMYod+X3oI+YIMsMYod+X3oI+YLsMYod+X3oI+YQ:q5d+X3I5d+X3V5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47A35471-2044-11EF-9DE9-520ACD40185F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423428179" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095fe6da2db084348b1cd78baf7a040f9000000000200000000001066000000010000200000007d1043c5fbefdb3fabfc07a70c5734663100618f8878c09322a89dc954f28e7f000000000e8000000002000020000000cdb6088d55e08902d3737b3efb3fad96cdd69711e416c9efa657284eaf31905d9000000072c1d4943405797d0dff229d58b33baca454412401813b78a20fb80243660e988164f68c448861138bab2c3b19898e500e0d569d6958d912279f0d12845ed858a94f4922d02ea5a20c18e03042d1d12cf12969c4695fc8a353bfc7111622588cfd60836d0dce6bd3b4132d7cd490c9d7ee9f470abb43e01b987e4e0ff930e1b59157153cbaa9ad31f4c9a8aa5478421d40000000c75c5d6537bd7f313d63bd3967abe17bdd8beafd166a95cab7b0fa44854378e106025efd84b9acb2a40a328a2766f090b22c5af7370863586f942bdcf8940163 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095fe6da2db084348b1cd78baf7a040f900000000020000000000106600000001000020000000d4994099c66c7f8ecc03b2ad3fe7f6b238b348cba19e0f99ddfe5d725ca78f25000000000e8000000002000020000000634896f1988ef7d814073d3fc0201869916dc1223a1ce31aee353b8786fef577200000009cff86d58a72084710f102e37f9abdc26f9269d9d0e20cdbf39b7dd31112f8f540000000db159ad3f3f7a1dec64f203c54ff5868f4908a55d29a582e166315543dda765fa5d39f8304b0f439d33360644869c72a7c4b41df2c7d835a4d24ca2e184559dc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a72e2051b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2944 iexplore.exe 2944 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2900 2944 iexplore.exe 28 PID 2944 wrote to memory of 2900 2944 iexplore.exe 28 PID 2944 wrote to memory of 2900 2944 iexplore.exe 28 PID 2944 wrote to memory of 2900 2944 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b5aafed6db891b3d9cdccad63598686_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d303505dba7921679edc95398dac0fd
SHA1983065a07cf01d1089eab74bc513e4eb240f4e2d
SHA25696fcdefb7b7e08c2f1c594b043c4c3e86388987191519ede89cef44a502b341e
SHA512c9de67184eacbc71f95805682c3135f659687fc5105aa04b5ae2489934b0d5c06c5c4b2d64854b89276460e268d15204d89bdc6bc1a81017f4c2eeb4accff1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b2b945a48dc83f0e6a63eb373b91dce
SHA1beba460352f08aeba915c0b33dda9f26428e4c49
SHA256402d37c81ca88e40ac2d8d82a14a00bd9a60935401bf17a1475412a4f3243010
SHA5121703ea4a5d437a0c87106ad9855b367155a2c658c7514d653b166b4ff25508e10c9976e0896422d0e88fcad224eee378a58bf5b42ff2ea58c563b066fe08fcde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1c3e8ad4943c431554004ad2827e167
SHA16a35dbaabb406ffeca10c7afd207005c4356ac79
SHA256e4fcf6f58e4c72c36c1175514571f20646bf3d4afb1f15cdaa4abf1db8d328d4
SHA512d1c7ccacae2235536e5643533d3bf37770600021ef0478a95a9883b237e5f4672a0d0ac59f4704f76bdfe8d2cf655ecf2ff012c2caf3473d2cfa54d041befc0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a3d64255d78b9e0cae9a968c372252d
SHA12be518d738d691afd6067d2ffae04a6eb9143dd6
SHA256e1cecee55d1a02bf8885e7f93d9e7109987f13a6039a38ec915763a73355eb2f
SHA512624b69f3d2ba69f608ca083f96e14f0c138dc30a6422bfaf4c27c4e375d356766f1e33fa1eedcfa9fd20ee5c67d3b0d614f4f0ff08044f46ba3d3154b2ea8355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a8d9820fc7b59434dd65ebfd2c37a3b
SHA1361e132ac648535b82bf5402f8ab04e6997b2805
SHA256474af94ca4e972cc038db89e9838119e0167da158e952c9e25d64d56444942e4
SHA51296d36bf50f566a8e712e32cee7a52524ca1bdad4a64f277b3475dbc95a2fae0e759be688b8e4f9e7429909c806e349b47fcf2e2627e7085315c196339ff9faf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf7e0717ead71a8a7323bad8337c05a5
SHA1335e1b64524927d5f5c05c4fe88f06532048ab6c
SHA256a17767e5e6458f20b37fc3fcf5d4ec11bb922d5daf82556505a53f3cd0079045
SHA512b5a2d1e50421bf30af35690e7a171052df1b6da2354ceff321000010e410750a6472c4c3379738d3f6f52d5f6ae15e44379329bc94cd5089ad8671cabe0ab7df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f89533e92a0c7bfe53d2299216a34883
SHA14aaec4dc6c4b7dbd3d054be5a87f046cfd9e12d8
SHA256c629a808118195fec64cfe88a77db1c1c978f6ce0fc637190fadc4bf6e6f8c8c
SHA5129fbd078e5f2a2fc1b0cf850db3caf15f8369a0e4558c9349bcafc8c897bfef3715eb2b6ab8aafac7006c9d716fdcec93e062eb3020c0efeb5c09f001d37e6765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a3578a041ab34e2645746d13a7ef751
SHA1cac095701029eab4ecaf57de1054bf85c96a1b64
SHA2566096c4e59dd0b36c4d971c2af43aaa12ef86625381f656895ce0b5f4fad09f77
SHA51257d41e00067491fbf0fb50caac557da0b467ece3ecc0e1df41e64788ec8b6405f5854af457324659d4e8c13c9235b41167e4d725a80d9ce88de48e8cf0b945c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f99765c22fa0effe5b5196df02f1783
SHA1f5b8a463ea975557227d96978b1ff5d6ddc89255
SHA256623531e4ef85505d4bb3ed899880273bcaf788462dd2302516359187ecaa343c
SHA5125b40ac1ba9efcdf6733ba1a4c967a3ee2e03adda2609abf5829a9828d8765c5fb5abd3bc5db65720d955ffc6a9b939c9014fad4a3bc8236f63d379b511a3cbdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fae56553aa5f78bee0b2644813eccc84
SHA123e7254e467eb41784ff3ed96840f7155c8d5143
SHA25643c9aac8e27c6d2f698cb3def77f6530a29d95cd2352b097a91b961b9644e2be
SHA512d9be2fb3911b7dcf98d4eeb26368e7e2a101c2ec1be52f1ad7f3a0a4e1ffa471927bb99bc676621f8f2b6022fe670a273bd2c881e07e4f8db2725231a0ba1ade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cdc03d4c89962d8324e79a115b15de2
SHA1d5917934b2c69a8cfc431f9e58c7a2e47631a7ac
SHA25615c0bfb75bfbb83b64f50d499a8c6ad10b4c8e7edb892675a2b4aa56ddf337aa
SHA512484f707a5a57a8246b4ce1e344f5a16d3e1b589a51126c5c07a588f93f83e580727ae0390da6cc9e77fbaeabc119cb3b12d2c32624bd834d437ffcbd522311e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6b9778879fd4c39431af2982a3e2c83
SHA19fdc252a7a1b55c58afb1bfcacc18f631d5477e3
SHA256a8e8485f546632d8b4ac31f0792a79ea7450bf2a239bbddeb4be7ea3d25917eb
SHA5125317062841c1ee6dc0e0f4ed8309efe9d58948492ab3b1281c1a5f0c786bb89ebebf266a8856f388c2aad53154a304c6625c5a48ecc71c8435a16380f8db66a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e7dfe772a857966fc2a154520e1ece2
SHA1ac6358b83bdf70197909765a6496e4603690bfb0
SHA256c28e3778f4092964afd526e2247ef31a6141e1ff5ceb675ea3288a8f43bbfa8a
SHA5127920b12ff670cf5d328fbd07d587a280529127607efdd0bcf70cf08bc4607edd65db86ec357a95be8408f5fd30576be032b0f662dd9be75de6145a159ae86a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58722bb8472b1f392b0bfb0a367525237
SHA16545dabe245e19e85a4b31bdf1974826bda1b738
SHA256470bf4963928f760e6e52e1c827e0052702dc5c7fda0f32860d94baf3a7c0090
SHA512ac9e7f3ed77ae1720c14fbba97e1170e61f1fc97bd104441726f510f3243fc107c9f3cf7596b65901228b30755f9566b90142fc9df4d1b78cd4455b3ac1e9708
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7d5466bb081eb619e7410a584eae824
SHA1b6ef8f4d9401f425ae971ef0fbbe2f9d4f089efb
SHA256051bbd4884e21983f886e239011b09ad623222ecbd2e4fe81aad717ecb7d3ca2
SHA5126062c779e2ee2186df8dc74d6d998b96845f9534a4e67c5372e899df77b4d192908d13d2ee9ca82eba40da0398e5967b83ea5b87ddbc984ea33e2d134dbac847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca14577d1ccd7c6d202585960a2d5b42
SHA12749b936ad891d951f4fa435c6019b71d747e14f
SHA2562f55281beb1eeb830bcf23b106c593c2c7daef96c71832ba7c2880318808c7d9
SHA51292f984a690c2bc8f2971d0b694c29a59c65c58001710a61fe991da6fcc96bf5a059e5b68c4f6f5d1e29b08d3ac250504f47fcf2368416536428c15d95eefc9ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2d6c4298b9d04c7f3ab030c3c3f772e
SHA1e9868d6f930d84bd9909f3b1204e7fcc405e85af
SHA256d5b662e0990d0a4ae3d223d7d58afd6355525b0ab92b8ef9c0d695139f1e8d62
SHA512d116a549c81ddfa14214735e881cafc37dcef802aac991d1a07a019d47784cc976a139c526503e01973af3cf3c2a6618d8b07accc99f504f57cc3054ca256225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5414f8a817a85535d97731771829b9924
SHA1d2e78c76641a1b0bdd4e0b00f12a412d14a1fa9b
SHA256aaad5e9b9865aafd22c2e4e016d3cb349571dd9bcd96affdb40c24ce89ee69b9
SHA512d439301a1b19a19dc5590c31db70771fa0b0aa6a7760ae90da026726e2d591123420a2cc567ee81e7dc12fde001a9769dec72802713b7e4e0aadb6e8570a1e9e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b