Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
8de7f17bf0c5fc6258090c93de886af8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8de7f17bf0c5fc6258090c93de886af8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8de7f17bf0c5fc6258090c93de886af8_JaffaCakes118.html
-
Size
925B
-
MD5
8de7f17bf0c5fc6258090c93de886af8
-
SHA1
0de8813ff820ce92d7b9db222843f7aaface240e
-
SHA256
5ba4eedc80b6806a096c19f3bf5ffce7bc91617d5f11218f3e2171e10397d770
-
SHA512
959f43e33de3f8f8a395bcc0a8fe203a48d9fac419a9ac828b97ec243b9f53d49f2ad7cbabfc3bf6659cfab889d7bc44024122c9a921d545078bed59ccc34b97
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00db83ddfb4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000932feb25d520794faa1df942918efac500000000020000000000106600000001000020000000dea7dffb915cc95752e099a2dfb6726ccd550eff4fdd382cf01e0f852775aa0e000000000e8000000002000020000000b7fec1dd67598174a4f7c7ac8687ede841c5780f00cd95777ca048e202e22888200000007e0030ee375c281dc09a02cf31039f685c64d9325ebe4ffd7456145818d95da040000000823dcac530c6c4ae1eed4acad32d369316117685a11f827f69ab6ecb68a78c82ba4356585b42b86314afb6c21e2ebacd02937b1c8af315cea156696cf532bb6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000932feb25d520794faa1df942918efac5000000000200000000001066000000010000200000005ff30825763d2f4af428d0f932f4607b465527fe66e6f051361a733818caeaaf000000000e8000000002000020000000eda35b3cdca120bc714a37b5602a7afbdd9b9dc65d41c6aac9ca9cf100a7b1b390000000b2b00fabfea3be3fec2795a2e9a7f70cc60e82f756e99c45bcb8259c2f8bc8f1afb419e3eb23d71358a832edad1ac0aaac7de18c0eb697ff6e7a7ef274ae839a8b733682289d05ff509fe412f1eaecaed6069fe9c0fdfa9c6b593a29046158f2e98e9bce263216ffb4a54037643d622bf9428a85d5ead79610d6e39fa5b245a9a2110c670789c3051e56deba7da6ad5c40000000159cce4e6963352d25d67c27b2e4d9bab71201e9223df39642ddb189290b53c5453f4da0dbacd069149634c634ae90d4b420e0b28f0bebf3a555a45361916421 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423489223" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68927B51-20D2-11EF-B35F-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2504 3048 iexplore.exe 28 PID 3048 wrote to memory of 2504 3048 iexplore.exe 28 PID 3048 wrote to memory of 2504 3048 iexplore.exe 28 PID 3048 wrote to memory of 2504 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8de7f17bf0c5fc6258090c93de886af8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54facccc00ac9f7f914fad23828cd8503
SHA12a5e4dd3641e4a2aef0a07d7c1064106ea3ed07f
SHA256c1f5c4ca7d811dc50f01d95152b43697e364c9d98a2b4cc306135c28ec7c1f74
SHA51256e5a19f33821bbd45e4b52140c2992560ea32b1d2b401c17d84b44d4e1fc097e1ba9d481a5ea66148ee0b410517c9dea346bdb958f6d58116bca5d54c4d05f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576d8dc26b9fb7aca324156d7efb9c802
SHA1d4a02393efe097c9d112ec68a0aaf852b750c2d0
SHA2560cb783f6d71893b28c3a66f5731c17b4632945902f5bd8ed42e653c7e9fef500
SHA5120220184eb4b9acd49ce6fe9c00ac56d790e24fdbf6d019f148a39291e3cb389808a107d8b7c02f781b91d1457df9df539c6b2a70e336e9b935165c64a3b1830d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5606e29594b2081a4725334f813f433b3
SHA1aa8c1acd336834423182dc9e37dcaef79ef09f62
SHA2564da65e28b858096356cb503adf0ce49893642edb3a4c35c4b3a8636cb3c25a89
SHA51298ab470553b7921582f895efbf917c6b16ff72ebceccdcc97d56fea50b7659d4ec607903390c48f39e1cca1c6c3aa9cf346286de6f9614af0a243cca8947dbd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b58eefe1450e891b09d6725749d5f055
SHA1f8fee2fc4261a01f86fdec6abae814082c325719
SHA2563b9110dad5649f9b3c7a1853fe7f9da3d8290882b558aa9c0761fd3c7d9b3024
SHA512866a5914b3aa125dcc9684fd53927c24bef31dffae63401175cbc54962a6466e23790163508bd4025cc7f37f7e3c9ba32509eb78ad5886ba0930c1ac4405d610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bed735eab6d6d35fda32bb01c8c93e0c
SHA15146aa2cbec3d93aa527cf39444aa73709e556e3
SHA2569a4cb9ccf17cc7a19e9189ee6351877b249850e7b9218c3b5b5109f2a8d58028
SHA512e0374ee95c72b0f96ce76e4206196242400d9d4040297393d059b8f411109cd97cbf0609bd1f5c3bb498e53b55c7586f56762c9e8c363af91bec8fd5597bbaa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdb0c58044bb9227ff04ec14baa15e2a
SHA1999aac870d78809b16a108c7c3dd79f5adaf2d9b
SHA25656da02e6647cd70a1e0b983c8a0ef682ceb4ab9d66c38761dbec399df332bf15
SHA5124e0fed53f4f030a7ebc96033dc12fbb017daf3859f93589a7f51473108d92f90ab2f611fe50d9e0128fd887aae9b32e9b352acb4902d21210f4289f2c22881cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501b3a628cb7a73a3d60ffa041c63089b
SHA151ea04a6408e349c218f0e80b46466183c6946a8
SHA2561d71d5ace6c65556a9e9f9f1384eb47c586ba6e2364f48250fb724cb9c735c9a
SHA5123654b403f44f6113f75ba7b247575a69b7a4a70538a14112379661176fce9fa7f35b9bdbef00b48a6e2ae9ce7848e3abcde1b6c5bca6011ecc8b60f6b1ba80d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a0af18b82d4fa1bfac0941c6677e4a
SHA1dfc9f7b55c9c67766616a12367902a9872eca2c9
SHA2562c04ad236f0ccd9c4f67b7dd95f603f755a727594150a12781fe435f66b4e325
SHA512002fecc7b6cd36c7c2b71535f081f8da5da797db4bfeb908faa91122ae06725ba3388a2b26bac4c27fe7f2419bb59eb371f1e7fa4016cd56c7869f325db659cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e45642d534a6b985c2c6ee2983c1211
SHA140276f5bd9f90ed2c1cd726d314fd06c1322c4ae
SHA25608cdacfc9bd887b8b3b51e2c102d5442c163ece14b3cfbddd17a9ba9bbca44f1
SHA512c756df7a0e74a5f466adb6a3cc417ada554144ef36b54623755f0a6d3361d8533353dfe37c422e96fd647cadd1985e6bdc72384fa2899c25634262d6b91a5eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500950b451b542d7481825e50a400d9c0
SHA19e03b5de6be0ca2488758b1c1604c4863caad3ea
SHA25659308521d3e43c6c26193abaee7f5070815e6a4466c342ff2bcc50894085f711
SHA5128e5f2ba11dc6f9b19deb4ed48926328e382ac87d2acb652b4e32e5aefad6bfb04c49eab3ed14454b9f569abba93caeb98cc70ba49e62a169c00ebaeed09e8404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b5390a7ab4497cbaa567783351582ff
SHA1aa8bc42e9568ce8ac0c40983b2c78e4908dde6d2
SHA2566f1e99061530db7dce6e26eb0c3e88f2e29eadf4992fe1c3e474eee460df970e
SHA512841896e0e307cbfb18b57d9bf05e9c8566720b936c2e00eb8b9496dd29d9d7465c93b1887af491eb6f248cb151d828e95fcfda1c47563ec8ca46f7cae5904050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5276a7d9f7a37a45d0428eb6b5fff083d
SHA13245f0c3c38200ed5a67f85f31be6e66873edc5e
SHA2564f5edb98e10d72f111424c4dc8e84602f13202c044733aa60889562fe320496c
SHA512ee5d312fe5f0367f1aa67e2f64d7e92f172e619646d7558705a54efbe487935617e2778698f7c06d713649074c45925494f79de38c7d258292417448c9c1f067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5372b5369a5aac05380c1e287d3800892
SHA130ad4aed2d52d5a7342dea966cc1e3bd88c67add
SHA256672ad6d78decc55ffa4a19de12c3c744c69bbc0bdce693716f043c57f1635783
SHA5127f38ec113226562d1eb4718313b1b1419b78f55cdbdcae9dfd04e87683bddd62e377c22bd2f8dedcf4c8d2a07dac184b411a151eb9fc760eb414aeec08b3ee5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f288710be46052847c38002fe5d25132
SHA1a354ecefa0bf329ed3616dd5922d837b7778d411
SHA256ebdd236a44aca89e258f083cf0585dcc245e390df14de2fa02f161219a550da8
SHA5126b6f319bf85fb99bf744c1bd43e7a344c66aaf9ce99d352144f35878a70bd34c79bb855f16ab053979b0fb0ca387e54f29069296ab6ecba68cb6369299f93d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519e1add574449e05854b27d6da03e6ab
SHA182eb906e41fd580882e6484bf69af288ee46f7e5
SHA25617bdb0b5991c7ab1bce7de4001b023c8bfa70b56ed409c0f95adb01afb58286c
SHA512154ebf2cac55f5a2b2f0104ccd1de97de9e803f90fa4ff6543fadb9f3998497beb093f2eba3cbc2120c40a881ad9efc4e6a41d0e575070e201e8f3946743b8cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0be8384594df24665c5285ad8aaadef
SHA18ec6209e440e5689187de88a30f2a9ee8d21f486
SHA256bf5a37db8747661622900f8c0590514f06600ee4a2b56e7614fc8fe6591931a9
SHA512dc38f273f93f45b450a9235a76d7389b0cd0976dee604d2551c942c9e9a6c9f593525d7d3aa7dbae8e8795980e328e2dd841fc494e884ff614cb5b9c314db5bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b5bd569f2e74f29373fa07788b5c13b
SHA1d3cee3d7befd9d25f0d945373a0df10b3d57f0fb
SHA256bbb380c2b503f57ebfbb88c476716307c9abb8acb32432c732b0e595f293ddff
SHA512ccb9d9f70e5d6d9a5e4d803e880cb95fc28c41bc340c834bb0f07840a51a89f4e148f1311318783e454dcbfc39e53f2eae472819ed917045bcba60184a0a7e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d3b6fc75ce68abaf356ab9f7ce0a852
SHA1d0b2b407982fc7218ef2e236e52f0e6dbee7f3e1
SHA2564f1c79b12af0554df30087f1cc3e45ec2d7546d87c85433602cb25961702737a
SHA51222894b33cbd4d1b698b84496ffb8e167a56e5a96abb5dadf77036c88c5f3c034ac04e1d6eeab6148263c0adc673cf04ab36e903257a78728168074c70e1ac08a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebff9b5d309a57775b1da3cca90a88f2
SHA1fd16f3e1e648d7b5d007e7cc2e51544cb365fadd
SHA2564949b53828ce13235df9402c1a898a00121450332bb8cbe51c5541bf79ab45ca
SHA512cfad390db4da37495d7a46e7716aad6c5eeb5797e6fe73639fcc3ce6717a96c01a6c92a8c909377b5afe2c7979a76f983bec46968b55080e1a1e0a8008c59abd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b