Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
92e6ab4b3e5ff6fe19a2ec3d2f4f46b8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92e6ab4b3e5ff6fe19a2ec3d2f4f46b8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
92e6ab4b3e5ff6fe19a2ec3d2f4f46b8_JaffaCakes118.html
-
Size
4KB
-
MD5
92e6ab4b3e5ff6fe19a2ec3d2f4f46b8
-
SHA1
ad25a032a6845b8a83611cbb20f84eba202ac95b
-
SHA256
e3f30c4a00c5d795ffb09210c53b0391fa82a13f34c04e8c081f5d6554bfb488
-
SHA512
655e732d8bb886e358381ab1e95230ddddb7ec1502bcdee37285297df67f40e9256f066a061fa6512b1fa1504213b85a8ab16a265fb3b8b4f7a5d66532a21f44
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oUijjSFO:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423617412" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085fa428a3821f843964a403942e5ec420000000002000000000010660000000100002000000041c385496f22ee1f1046667aa4b08ff83391eff8ada6f5d4234c63f0661ca712000000000e8000000002000020000000d67f90c508e229b6dd7c092ee645c453bd64e664f24b5f76966deede63e5951f9000000040df4e742cadaee32bcfb0539d684d6fa046ced732b47912d199824df3550b6f101f849f0ac58536425b98aa47761bf9278375b3fd5990591fcd0305f528da4368b32d398c1f0789c0f05a9c5a70b50cd8a0faeafac0df0c751d73788cc346e8a0ed2ac5b96758832662512db59289296b6739853a73a1ed33393804085e0924bf1dfb25e6f8b33698ab983a0bfb24e9400000002091b85af4a61c888919155e20656bf98b6f2783d186bcf5053849366057a697b84fc145506f5ce079589c369d40b7b61e4fb42a242cd27fb2c7ac9a109c6c05 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085fa428a3821f843964a403942e5ec4200000000020000000000106600000001000020000000ecf2e5f2bb2123581d0ab2c036f2b14c694082a10cd5951c9ce28a2256f6eb53000000000e80000000020000200000006261c82ebe209cd89cfc0fbf15c57d6bc666e48f208317176c8645c411cb3deb20000000ad8c6f2a56e0b36282158fdb5950bd6f180fd9886b2a9a0e6e562466f6dc416340000000ca1dcd6d4a5d11ca73ad9c8e1954c64df31b85af24dedb4238446629b47b0b62e909fc8a6807a37fa1b21a37ed075ce39fa5b21ec28289847cb2bd274cdd942f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ab91b309b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DEB58541-21FC-11EF-9667-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2000 3016 iexplore.exe 28 PID 3016 wrote to memory of 2000 3016 iexplore.exe 28 PID 3016 wrote to memory of 2000 3016 iexplore.exe 28 PID 3016 wrote to memory of 2000 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92e6ab4b3e5ff6fe19a2ec3d2f4f46b8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59036b6633f96b72e272bb3329e27fd04
SHA1bbb1cafb50e51c9a5bda3b44cc937099206d5b25
SHA25600e0d2ae14cdaad3c170ef19e9d27c618e13ec0e7bb4db4e2fee8e25568643fc
SHA51253e34d16bd76ec10185bacaac4cc33622cffe0496827733d3024c38c4b8291f0b41f55a630b38c9b5519328b3b985c98c3ce1e61a4af973059825891544d68f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54178f1bfa2aec9c58643e84184aacbab
SHA173d1b16b20ac2728cb064adab257702ba465a18f
SHA25681417a44fd4232a37c07fb6187a71d2372a167ec2717092b90c80297df58b364
SHA5129a57e754d83d306a10a4469f1e8705ae8051bd63f94396c969f5d61239da54dd32c3955d6b668b294157a59b4bd36b852ad2bf952fc9497bfed768c1af310a71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5542cc6001fea59bd3e8fdea845338aa7
SHA195911478ce238d8b1d18745c21ad17f5251bca8a
SHA256ea32ce1ec3b34404597a99787281dde5afb8c3638beb79d0d96c4073179f9e33
SHA512794df76235a016d462571933264f4655321ce7053931911a2872783afef6fee39383b2e70b354f7f39ee584eafcc76997f1db5370c7ca34c45336baa57d6fbba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53111e208ddc9c21031b367acc092a0d6
SHA1cde98a68cc5eabd21ce5116f50e8d5769f198d3a
SHA2566c6a2310445fed01d0f097982e25afc5c4c3eb25518c268bf203a7e06b759cdf
SHA512373d5546ca1a0da4d021aa9de9a8a5532a912d45637f6849c93ff2e2ad6244d18a4f6c86ccb82e4671b6ea72a83ad6ef0a59c013dbde30befd3af32950449146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549dfcdf34638ae86a84208862b9c0243
SHA1265bfff7db53df3c9dc03a47f015c38f957e5cad
SHA256238f01e84e8bc456064122cd029571fc3c5551c2de6f6e9d10bf46c4233998b4
SHA512ba6bc59da704ee168dfd23e4373468ef588250b533a0755312a677a52ab7410a53c7612be1f49b008cc1829d3f6bb6b5acd77b8ef9c32b0463d5d5ac46a07881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0840c30d76cbf73a28598d1389037eb
SHA1604c9857fe1dddf1a0e86350eb2c1692c96bc905
SHA256e5e47ed21da38a89cb20021d3ce2c93f13dc3c7ff6f0cbd898eee9f3e9652d59
SHA5129f825a47fda58ca460d42492cb2457e66aaf71355d7bd65237e9ca44b3178276cdf836b42552527377c35e20eff5cdd073db0d6057877024809b57530674f8a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d28683fab004ffcdfc73c8b8aa86b105
SHA1f0d7256b74df1ba52ae7eda610333e44aff832d6
SHA2563c14ab740cdf70b13e49879aae28aa14b2a644c2c3ff684dcfba374edf8ee0be
SHA512c2d2496eb7e503532b8d40e165477acdd7fb35c6010dc516f0b22d825182b5bd802b1846f12b262888fd2c5422ed9e856a5da56bcc7b221d7673d0a465bce59f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a57fd77835e4e864c3a830ecc8dca1b
SHA1e46695d0e63627f7d0aea5e7fa55d9529ea864a3
SHA2560db29e96810912eedb3394b9fa0e48c7ac5d8d1433b4b710116d5aed5edb3b39
SHA512c72bfbbed629f792604dbac99b6b9acefda20ec4c67150c98b57bf52d3d220f503eee64852f50d51d11c3057ed50f4935358d65c1307793b77267334a0c61af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5907910fa54be2297088d9acf8fb04614
SHA13bc548cd464f10a85cdd8ce0a3d8bbd04e26cc66
SHA2565f53c6e844d524120d0a849c8f9bf6a0cd421b369ed45d6e41e6cfb643691083
SHA51207ab1e0fbb807808a4dead672dd1207294e738e8daa2a118b562f6f31b880a65e54d26c92a97eb74114dfcc941bde6ff58c9ee24785ac271704891812a0f8bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524fa651958f98979e3e36a877724b64f
SHA1fb8fcbb94f57ccc360dc9f84603f2ab0e3d34a8c
SHA2563ffdffabfcf4689358cd409e69c56d3db9ca21300906d9eac2abb7342371aedc
SHA512f84af839cacd2dc095cc875487015837813d608e8874ed2be78e97eed76d989fbe6260a6318966d0f6c70f4f56232c2bad89b5ddf4a4bf6b1f20be3bb333f169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe016728d836d0b731db7da404ad66f7
SHA14f4c458fc1988a993ca13ba0d7708187ec285e62
SHA25688231df9f9b87702533f0e00cb8636ef0f3ca5ad7ce666bb78a6dac836fdfd85
SHA512d64c9ca875adde756e1f72254a8d86950cdbd3a3b5f749d157ea31d08e660c2a3fe68d9d9c88c1dcde18e738393d02ed0a0601b55b6960366a6b4e3b767ac99c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e36ff0be31c2410ea08a07c66440b909
SHA12ad0b3e01021de9a4e0f8e6dc793d5e190e04253
SHA2566290fc67c16dce2fd0c1b1892ff8f14d46e406cd579cf8773cfaf4a0e51efbe5
SHA5127311bc821ea4dcf4275c3359588647e34a62117541220eae38cfc542d1989851a76fa885f89e6ed7038ebf860d1d74fb1fb840d34e414d3f02e6fcb7e0f1f100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5509bd65488bc78891ae999ac1f60c47d
SHA1b4374be515cb67ba9841769e27425bfd098ede65
SHA25693b3504f884a58f6ef3b6eb720eb56878e65f0930220065fe659b2fa1d036966
SHA512fff41a6f50b230135a099d6cd0feb45d71292104eefc8dff067530c88f9e6afe8db568ecd3535d6da4f452466c7b5d19756c20a84710c64cc4cb97f353b04607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ab5d61301573e61104a16fe98fc6580
SHA16500856c8cfda719703fc20dccd74d286b5d5d5c
SHA2567cbc00a7dae373d0ccf1add7ca8542b29308b71b79f442f7889f9dcbe4f4a13d
SHA5129b0e7bf2b2bbc68323ecea7f3728a6b086f14ba513b700b32b55c3343626cd179dbd96130eac07a40addfff048ba83df1c13ee842c24daab606c6122cb1f7188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592155c7786e74ab8d5a0d4687763af97
SHA1450dc07e899b5e3de1a6800efc0833315b115211
SHA256f9f5d4e79774ae921397a9dc85055b0424e0890ef3a247c8176b877f5f4e1d23
SHA512422b52344022ac09d43bc2f8486dba69919841e1de47bae3130649826fda6ee4284b73a6806dd59a6ad8ac3e7a008a59233c4a151dd71ce36cb6d490041abc6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e0e44edc73a7de9955cb4286cc4a97a
SHA1bd36e9f751b043a2adba1dd920d24e513d0cb6c4
SHA256c371619579663aaebfaa3b39eb193a49361027ff1fc57aa4ccd664efd0bfbe2d
SHA5127e783bdfc5eee2ed00b3377a5344023fc51c38368afb3b18236c05c72fb86fe5c4ffd40feb7c3c52415a1f445d26ebc66810ce63e9292e7cc54d9805f0a67b96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b6579dd791d90fcbb9c999cca7cbaf
SHA1989b28ac068a8c5ee06f8842cf23659fc55ec55a
SHA256286d96a448156eaa94509ebaf4012ea7664a2bf825d4492708bcec4db7680ef5
SHA5124765220f012a5ed136e186f620e4ecf4fad39bfba63f8e4764a3067f2568e5a3316660a82b2caea25c904aa8824e26606e66b4fde49d2c49d6a620db87457ab6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dea12bd4610e2f97c351adca12f8a18
SHA19d6577075a58d08f098b57931c398a42e180e7b6
SHA256e56aa8324b51c3db18a9707f4e43116f759ae3950be3ab8ddfef23307d207b0f
SHA512ddbfd12e43a06c949d8aa21ff2bc69a333b2a98d9c94237dbd6dcffeea601efa0734a14cc243a7372d49da1fafdb6678a5c8cfc81eb1573bb54e16284e2bbc1d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b