Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
8c85325f52822cd6e8b6a011e1fd5851_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c85325f52822cd6e8b6a011e1fd5851_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8c85325f52822cd6e8b6a011e1fd5851_JaffaCakes118.html
-
Size
69KB
-
MD5
8c85325f52822cd6e8b6a011e1fd5851
-
SHA1
060fe7cae95ae2f960e4be4955627229ae667ff4
-
SHA256
508ff3203701dc3c1927a1254108bfefc465a34265f5815b41546cb781682315
-
SHA512
894c8d08899508229cae8b4941b7494dcc102b83fbd1d7c77b3f8c5ebf9f380bba7c4f53e1f602e20d0477a08113c1645dd346cf3e116db9e7afc7023df67e38
-
SSDEEP
768:JisgcMWR3sI2PDDnd0g6sd4Ud4rKY4RoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRe:JWEJ29mTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1279eb64a62b0458f924a18fe7f8b3d00000000020000000000106600000001000020000000aafff224dea5246ea514ce8e8a821f9a5e8cc9733020c3e2ac623d8b69a4e1a5000000000e8000000002000020000000ac580544b31e793559bdf89436d7150299ce216fa749b8be63b5c6ef7875d8a120000000f4f51568ce7016f0b981b13b408cd234bede3cb8ecebc1e853e1f048c18a8f0d40000000e4a197c3b90ab5e7aa3182ebc037d36f4ad05a7039b6bc2ebbf37606811d38958c16c83792b503859e321ba338ec82e97173fa3bd65aa4a2db2420824a7afcc1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1279eb64a62b0458f924a18fe7f8b3d0000000002000000000010660000000100002000000017e2805d8490a9699616645c799f18d40209ae7c15b9067a5b5e245b0f42d89e000000000e8000000002000020000000ef6575e8a7398419b9061c6c52f16a514da2ddc08b7354875d5775b266382cd9900000003153a1b763560d54bf6df44fe49524d625c1c86208da8a0896b194440e494255f30e99ec42f13f2369f57f169e64ae9fc4dd3e9f7604b502ee238d0a31b7496aff69184871a466c4518ea42a0db01612235f627635469c7c67300c1fc79c43c1afcde58cca37ec7514c7b623d3ec7709a92297f0166948652226d5f55dfe966224fcec87ef43f552dfca8d67102a667340000000a281a14637fa0dca525b256c89ce443fcbfd90f492a1293fee7a4265444c7cd057f0a8abba91fe077059e01c02938a82a8d41a87201db94111c2aca0c1bd4344 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423455043" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3E79E81-2082-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ca25a98fb4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 iexplore.exe 2076 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2064 2076 iexplore.exe 28 PID 2076 wrote to memory of 2064 2076 iexplore.exe 28 PID 2076 wrote to memory of 2064 2076 iexplore.exe 28 PID 2076 wrote to memory of 2064 2076 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c85325f52822cd6e8b6a011e1fd5851_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e95749e1fa3f979cbc02e7444237e62c
SHA19844a733c40ee15c6261dbc314e1eb2fe383b808
SHA2565d480d69fa1dcee9d6ec6952a91183c58ef7637121d1bea895ff5736ffcdfde2
SHA51235532ec03f9b20b97c2a8c728f70e353e5d0db78d25bf54e3c732a26afbe3532102c1d0140af6127eb3e67f633a3226f1c7f7c1df4217b3a2582887e6a5f152e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e42d8cc28863bcd6b875eeef10329126
SHA190f3f7ecfbb5ac3202c8bc879795d2626e58653d
SHA2567564b7fe4ea1333fe44318c2fa801cc673ac500d2294d2cafb5bab207a82d410
SHA5120a76dd271c122f78af4f098fc6dc2893f155b638d886ddb09991806f0f5418cd7a8b846370d5627fd36140ce462547efcae45b97ed931b1040b18b350b89196d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504cd03d059400a4187cd784e91ec5e5f
SHA1d3316db1b41f889a7d1fb211438c2c9e4be596b9
SHA256a3ccd8b1bb991c4237543d6faeeabec5192297d71d4ec9b50a91fd221dce022d
SHA512dedbd7f4269185195f835b029b384dca5120fc22b101286ba0459320e60680892514f1a1fa45c842e0136be13e4fc41f8f91dc48693cc2009a9d28cb3b65da04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e06fd198de08d5681f486b25b75bd7b
SHA15e5d02d9231012cfbd48ce7ce07252e3555ccefc
SHA2567694d0aa9fe3994125cc3a2ca5986ae515c16b8ff79314fbabbcf46576e4c853
SHA5125db8a7c4d784ad40ee8899c927092584e2d12aaafd24c92d8d6e1bb8032bce03dff672e1695fa15c9baa112b40853a5e03bc7b85a3be559943acc4a02975d561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520e7ff887ed58bf3a2f607d207ce29ad
SHA158dc4c95979b4243378331a99382e941f6d76f48
SHA25653c3ede2112d547abcaf5d878a02ead0bdd4998a04f5643d82c419dca888d6a0
SHA5126c3778bb4bb6d479266be2f9476814fbe3f6672aea7942ef99fa830548b0c806c0828e8ca17ace69f33cf3a48c581d59c24eb57574698b0d8fad5e65105071c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f78fa69c784d3524f09bc95b73360cb
SHA12924c85dac57488f6c3184f92d2d0bf58265a758
SHA256a8c497d19a8574dfa8d03fd28f3166fa59797a515f07f5cdef94bf2bd4050e99
SHA512e0b13c41637be4aef872f038ae8dd0a35f8ac72456ab6c3926a7991f29e40b5121072f911683d74122d7dcf4726053cd63d2e5ca4c70c5d3c483c66dfa9c6ab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bf367d92d0c906d3091c9dfb2f0cc4e
SHA136f135dd3b25942b26e056f45807de5586c1bd9d
SHA256a1807777027843ea11dbd119538346c1456d1d6298fb44271db53539e336c6ee
SHA512fdf39f880fbe87d9e735399b2b2368a1f85b9a579d7e7d8f4b7677a95aa90e901446c0b7d826eac7a23b5618934c1bae23475a036f912304d4293acd04c9d6a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5129eabaea186c5c24ff7558bbb41b641
SHA1d3787e34dfd2839b29ed630c1f326a39db9321f9
SHA2569dc363fcca5859d36c1322a01777c7d7cefce23b16e8a256914e91b4bdc7d230
SHA512fc55455c428102394899bc8939393493c31daa5cf5ae9b78858783dc381becdf57caaf382e4633d439155ec482e006468db465c77b8db4e0f5ec672013fd3e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d485884135ed6ec2f5962df0651a8b7c
SHA193bd9f0de2921b1648adf446a593b383433618ca
SHA2561ed5bfd32d2bb00cbad2c984797a3b86b0bf140587ba6c92f3e3e86b5f66fc5d
SHA512997cf0b8775bf7036e4e3500e7b15edb1f7973258ec475d4bb8f5ddaa017fc5204c6646feb858f8436d1fd3cbbb000124bd0fc1bdd6a54616b1455d8cf36d519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f2775f113ec98d18c0c4154e4bfeaa7
SHA14d10faaca5bf3c3c778f9febee8e1fbb27dfc146
SHA25673a76dea764993c7a42f6508f658d308105ad745d76e6d5b46058612e1a0d5ab
SHA5122fc0be5be840dbd9453f2c6e57bb4b3a3cf87aa5272f75df2281a593d276d3819c675409399991c3b2befa3832c0f0d1149b58a3df5be6f89776022a88f8f603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c197d41a8cd114b4e6129442d66d0e60
SHA104a870576813a92fafc8100d21edf90ed9f94063
SHA2562b496c524e22f8f0edc12e1a892814005b238b3f41fffaff18c4fc960921e501
SHA512c2cd3c39a0c69a5bb845e00cb4742185d7c9b1bf0030575bd0fbb23c23e2ebf99c29ecc486a09764a8a22c0596174e285c96de0eaf2f740244ffd579e45ec39d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4798d1f5602d97cac240061ca74e006
SHA189bf050fc1e9e322d2ce814d73da84c4147f8306
SHA2569f0c35467452712bb96ae09614f279162d0b443407fa4c916b12db94f7e67ff5
SHA512421e490de6274e38a024a657eb081f19dc42e13845fdc2880699f5eb95e281d85e49a2c7a1a9110a490a6dc9ac8602f7ca46d6b3fe077b64d6945535dbe741f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e59d1ddc18165c446b43150f71a2634e
SHA1733e4d9a08f6ccfbdc405f23d79eae6e1209d2e5
SHA256adab47aa604b78df472f851cf266ceb15abf46f3e41b36f0e36b64ea7ccc3a06
SHA5120038cd500eb69d593dd4ed465d7fc5cc283199c2a140c39cffd16035ad41c8a1d6401764fe358d6138b1283b258a53fe9496c539922688c6aa0440a0b4837f78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d644c760d78833b0fe7fb428677153b
SHA18c2173963716ebf71d430ce3565babd1db783f59
SHA256f71cb1f2bd449b55e32522f1a957f3482d2512066f08702e5945ea269577f8e1
SHA512230ff76eeef4455c21ea3db2f5b6a5fc81e940628c049ca7ac9610fc2f29bb34d0e6f44558f54521737ce6cf07558e83f2bbc89854a16ab2498e1256ec2f1842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50404aee057c557d7ad144c99a308f75b
SHA1cc335c27320f955de6d2158b21fd752b600beb4f
SHA2567672c9ee72210dc4986e4d9e9376625960d9e153037ff58a0a130811642d1b0d
SHA51239892a6fa1f2609cd3f599044f92df018e21d4115f054587c546dcf6fea6e046319bb45d557e28f6d2fbe63074b4fd593a326891537221245c55cd2fe8eeffd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508b96b94f8b53c67545b8d9552970169
SHA129c392b25f9c22b8a7fb5c8547c94a840a00c259
SHA256f4b7ff4238643f12ed1b9e1d2ac813eafd0919c33f3559d2342f44fb8e1bd7b7
SHA512263c88f9bf5a66ad5e759081e9857106809348da9b39a557918a1a6bdb3993dee97b4ade399cf268c97a5856216288875179c7af2d7de4058e2f74239a540757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575f9152fac46cf2fb01d545356345c11
SHA12ddaad8245f15009a07ee7856605b4e0879840cc
SHA256666f7bc17748ad69bbd687d2afc77f1963ebeab61bf0028637320f0761351e9a
SHA5129443f53e24ad5acb9f9d14e03e30b8bdec48d91a7e69188c156343107d9051412ebb0eec90cc70d1a95663d558d3eb3c5fd7df4a4c32696c51307885793e3908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b5d2cc6fb956f2886a685355d22666e
SHA1823bd85ba811c147d48c8484e5cef63357dd020c
SHA256fe332d47cf498a9e52c60e85e53b548da64309887c3326832c071a1d16ba63c2
SHA5121feb213c62eb2f6d3a12854b42865a72cc24ee4c4c203cde73548d1c317e1ce19ac00742a5f4ed1414186d0ddbe4073546c14a943a5501c289b30580449211c8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b