Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
8ec9164d4a95585fa17f0464308b95e4_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8ec9164d4a95585fa17f0464308b95e4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8ec9164d4a95585fa17f0464308b95e4_JaffaCakes118.html
-
Size
460KB
-
MD5
8ec9164d4a95585fa17f0464308b95e4
-
SHA1
ea1c5b2eafce727a48ac401bc9adcc33b59aac28
-
SHA256
1aaa0c29e52b06b4bcb40d7a63d4ba493138cf0c2624758f9871f06a088f7c05
-
SHA512
f49088e866698d68e4a2a84d07160153e6b92892a387c7dba032443701bd59930c9eaf5d48a34d05fb31fffa67fdc6095af734a30f2494c91f6217e06c895bea
-
SSDEEP
6144:S0sMYod+X3oI+Yp6sMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:h5d+X3TY5d+X3n5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423509459" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86E12281-2101-11EF-970D-EE42DE2196AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e804000000000200000000001066000000010000200000005dfdca3bbc88a2b583996417c08cce1faede27266090460c2b2a302e5cc2859c000000000e8000000002000020000000b1c343aba2167c30efa08267ea40640c7fb81dcf839b4fbba067fb72d724d7452000000077cb845a8767fe4359430307a1962a69eaf25a19a01a66d230f9086930c034f1400000005e7fc624f19ec520ccfcd525f6c0872b0f5e8728163fb23c07b18b091aa7427fe01ef636f0e65cab52d6e7918cdb899830de53b249e4372c11702c88fe8dc6a5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20506d5f0eb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e80400000000020000000000106600000001000020000000fd7a704169ead86cc16a8a36fe4ff9ee54665e2a30497c6e029bb7e74cda7649000000000e8000000002000020000000596a80591cafe24fae0f69f546af35cbdc0cf43eb1ae0732a26e2ce3ea3191259000000094e24252467e29a2692cc6059d121ba2ef468fd865a3364495fdbdbce45554f45a8f5189dcfa2c7d491608a60bbe6a85450c1b801669f115e6f25fa1980658bd85521943070c37b317863c3f4620499d4d03fb9b22cf617d447ef57147ae74316ed613719dc33ed463de0afc60fa1710678da34642e50ca82006657be97d5f02735d89ac7bb833a3ea8b57d496a56cb040000000b935e0c057f6e0ff099005efaa856334fcfd93d4726e0ceed8bcaa7ec8adb9c4eb59de3dd405e128a2a30d7740e55e4d634f3e466d5d95aed7e9a556938e7201 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3068 iexplore.exe 3068 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2368 3068 iexplore.exe 28 PID 3068 wrote to memory of 2368 3068 iexplore.exe 28 PID 3068 wrote to memory of 2368 3068 iexplore.exe 28 PID 3068 wrote to memory of 2368 3068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ec9164d4a95585fa17f0464308b95e4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594632555dc637f2170d99794e317d729
SHA1086352745b56948f2d2df485da433327d23a46ce
SHA256df875ee04e2650ec23126a8910735b55fcf276a1d03368cd35a80989bfb24a56
SHA512df8a98324bcdb2378239b05199387c2c99679e0ca1801e743fef87bfb58d04538386e1d250712755a76bf09af810dd5539b2201b824c67b983beb27ff6ccc1ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0f5127bbe054417e3088979d873bd96
SHA11ade23deae9c5bbac366d763231d83afde0eaadf
SHA256542cbf0e7766205bd923ca418c3cd0b74fb516d530f9436ade12657d4cb71bfb
SHA512a66e07eadb7951f996bf54d1785727756e02b3c455fc78161b9b6d1899ea82e1ad8a5c54e001180a2bd6f287f7dc03449c036a18b686a8e30fd69e464393bbc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2c550b38747b892a6eaf1d7e32e29d7
SHA189ee4b8fc702f04a6fbfba2269af88f8385fd1f9
SHA256e7ddb1bf6c7173e1f9abb9a3234c9c260410dc4c4b129ebe86265443d54bbd5d
SHA512eeb61eef61f3e67dc75447c39d5041c6fec32884910493056c541b070ab3b19bf0d7e19c71d5f731cc357f4e66497c6b359207c2dae63ae2835b9467a4386469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500c77af3e83475a80b261b392350fb4d
SHA1755f8fb4b150f9cd76cdbae2dd8cbe35edcb9370
SHA256d3329bf0905372a7dcfe274b3f2f24188bc19e31ffb876a9ac0a55884e0047af
SHA51213f9612954c010f9f5dc2c3ae86115dd233fa7f5843be39ef5cd178974b240a46caa4ebac792adf2c9b389e44d2948573fa2fcdaf825839ba6fb9b1245f70326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df425e60a16b1e7428b9696b6689bf0f
SHA1ed2b4936ba8206c42726b33e4a60aa4b7016994b
SHA2561e9ff9dfa23ddf69427a73a4e910aff3132dc2debee10c1b7053abe3ffcd008a
SHA5123816b3242e2223e92e7b8bf96543fff45c27635075e728c0041d86e99c916d794ff2fe8f921fe5b3ab0d3378eef4b263370191a4bcf053437b32824e7e1b1bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b523ea0313bde2cb4d6767e5745c9cba
SHA1a67f0b94677c615d699dfdeffd02d62d97f1d476
SHA256a75c781b9ed94aa4fe59c52a8f005110f67acf82806759a17b81ffa2ea1d3ca5
SHA512bd0d719780110e3096608e802917672c35530dcd25198b72711ab4a3efec8c43dd6ebc67ffa03552d8f4914a38ff70504ffc8171d422a5fea4485a87786d6731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518f3c71f508b8c202eeeaa186f2b616a
SHA1a949f2b4d264971694810a58b5d3cdc1ece65f87
SHA256f9b6794c6d207a0edd186452124c3294b319f172d4eacf4ae87e9ae2700f3af8
SHA512c51a9a28a6eb809ddb26fe6f53f30cadfef90f3a64f3bccf5b39e076e51cb672464327d71c1dccfcb7855a19c410d47af040c72db6a501871f774056ffd3cb1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b891b03294b7c267e762350f814e8865
SHA124b6a57c882960a298d6afd4ea981f1171e38bd9
SHA256673ba5375145946a63582a668a9e2d039563e1e4dc9a7d3d6b6d99c1c7d87aeb
SHA51240f1bfeb3224b04ecfd6bb5ede51d171e5ec884068185be78801aebf2dc12f78b3683f0a38bb3ab5b71da58d84815cdbff79def9102dfceee5b2da2699478fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6753e3e78deca02b36ae8647659c0da
SHA1cd506aa1b4193c5abb836b37747a0c7159b109d1
SHA25613d454a267658c56d9eb174d0cefe83a6d4e63842bf5200393e90cad586764a9
SHA5121e3ed434b7e9d38338bd124c7007c2b63c19e4e30fea8e5e69cca4b4c2bb55ea7c81328b1712fb6fc1a4b4e86766ac110963b23e6abf715d1bb26da10d6601fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1160aeda11b4009d26980fefb27da1c
SHA1d1a83f5d5955b398daf058be013954c3a5012c4e
SHA25662996812f6560c21d66b5cb4583c8d98263d95a0a44338b137139cc9c4302a83
SHA5125c17da1485a8ab476c9c58b298f96f2e6d984f0d8aeef0a3c129d4d111ea4e7c4035fc48ac16dba3517b2f3d19897652f6e786c3655f61e5a3e7c42390188bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e310687bd85803b6446e6ebd396ff1c6
SHA132c9d6707f16bce3c61f7b723fa2c0e5c9b9d3d0
SHA2564f02f72e34dc03849572d360783fd4ee0d894fde8afaa6cca6c5c355afba09a6
SHA512a1080581ec5e8e005ba75dec79880a0cee79a504166b907e0835f37c77f99a6206415ef7ae3813c1cf03af8609ae97b8a1548e3cbce39b983b8096edef135d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557d459b63654b82c1b4eec3df163dea3
SHA1df3be68ea59f14bb6980a2b8b3b08f27aa36690b
SHA256a91556449d2ce7ec8c43941806ae27bd5c572f483f76b17c4adc2f2d6b2b0c60
SHA5121e562a45d2db31260beaf94465c44cdfa3d9b55dd93a660c53f3596c5422ad2e4e10c198d7a45bb339dd576b8fc232e0bf81e2fdb3c437d15a081bdbd782a3d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b04036bca87c273fd650d4f1bf5c773e
SHA14d586ad25b309364880990ddc1c2e1d84034fd79
SHA256aef1746e7b55c6aecfd3335363f1d341d93fcaddca6a2a49a63eac17cb6dfc57
SHA512a7e316164174702f195bf07b6a8597afd4377447298435c0ae51cae30d1b521bfbfb5c8a6bcc9a53410e70770a912e847c3516fcac71d84f9e8380c3d8dd4ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57519ae27d6c9e043ae228d7c6ce13e9d
SHA172bbc6547fe51ca39353e570c61257dabfd9d6b1
SHA25682c5a6ac7df75a2e41cf18001725c540af2084bcd015c0625ac32035b52668cd
SHA512d6b2751c7c07f596bc7dac4028e95a9c33d9a0f3ebd8f2908e4c19cb89e66af1b522887f0445ba67d930089701e46199aac60e51c53ab8f11d81ef6670142376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c84882ba9d6e48206fb12be94bffd875
SHA1d528a31f5162245b0f3086abaa5fad378060bfee
SHA256fbf5a8dd392311f6d511d980f7f91eeffca5556315db11b944dc53ddeb4cbe55
SHA5126e4cad6f82f1401b74f9f799485e1820f266d94df9a9b0de5874333aa16ffc89170d5b87af367938028c1beb640f7c2a2718582ce9dcbe1ceccdc282233d22e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5316c68cb2a7ecaa7fe49cef7592d7d1c
SHA1c7457f508041b74cc988c2147d349a1474d4e9fe
SHA2563b8f9d6751d1f4339df4a2f3208c71b997afa1835f4d36811ded50cad26f5672
SHA512b48f63a6dddf51cccd53d7fee9ca01c9ae250439f351e1b910545e62ad0ec92afcb7eefd5077afce57aff9992ccb345d12bbe6babbe15cc4886822793459a0d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58939f2148d6f34f722671247aa38091d
SHA1b73d7382f450170f8a80ae21c305cd001669a981
SHA2563a7069b40c56d1ff350c77b751edf53a5f417c6be3a5ebaccdf9d2fdf47c40dc
SHA5128b912f9fdcd80bce4548bba984b2c783e1182492cf1d7490fd61d43fd05a204151119fff0bb0736aec6fa7da74b086b58da60a8ddee85d800c05e5f314f76454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3f46dc646b639c5280101c19f1194e5
SHA1e6ab3b14b827df80f9495454f5a7ef2a47d54ec3
SHA256d421a3ccc1796bc6f2b6633c619aaa2cdb9b2ca44ff91de373c219e24a70e507
SHA5121763d23c4c3fc25c062a5c267373532fe039f005f24a1554c4555cc2f01d4828934c75ed0bfb9fe137e6c1d77fbea488dbd8d4dc8bd4923e0be5e87138367b30
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b