Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
9111f4450cde40ae75a2f41f92670cd4_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9111f4450cde40ae75a2f41f92670cd4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9111f4450cde40ae75a2f41f92670cd4_JaffaCakes118.html
-
Size
462KB
-
MD5
9111f4450cde40ae75a2f41f92670cd4
-
SHA1
5c80af8f718142f8aacd522eb4d85b9e6ec39219
-
SHA256
6e07805bbd19462020054be5b9db068e68a313ed1a52f8e181d70a696f1c3841
-
SHA512
a6699bd7c123ce2d483b85fb78d119f6de470f9ded875ce39567b29d8da3e177ed2e15cfd1f36e73c26f95bb2c1e7b5e4c29c4a79dfc546608833f7dae6ff662
-
SSDEEP
6144:SfsMYod+X3oI+YnOsMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3K5d+X3i5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE7DAF21-2180-11EF-970D-EE42DE2196AB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00610eb78db5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e804000000000200000000001066000000010000200000002cfa8abba419baf696f6c8f3e725ec97fed34ade7fb5830ddde033d9a599ec4b000000000e800000000200002000000067ba908a03bba5e9ce2ba4fe36884cf51d95ef8b44829e0d75752d276060fffe90000000861e23946d92d2f25138f3e74d74142ad30ac8e5807de073a9ac98c14b1162567a9992ac1141873c3c59d443e17355d88aa86a25266a1964766a900c92f757349b132c82a7ad6a7788625a392ef2de9398f16ff1e911c983de72eb077d8136362db7729a4a86c212e4ea95d294c9ffe71165623cb0c2aa7a9c21ab33b2ae55e28581fd9a968de9ec347a17a2bbd6aa1640000000ebf450435d322abcb4caea2dfc15502c0feff523ff13a48fca8a55696b9bc9e1642674ac6e90b5c4e4f150364e6a2d9a0f45aac9b8eeda55b8d62ed795ab09bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423564152" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e804000000000200000000001066000000010000200000006952a6e4adb6bc29f29d0c6a7962bf356029fb6e15ad23069f824a4112e9dd82000000000e8000000002000020000000dd88103c1d90885c270cb3314f4fe6b3d799de24d449b30e93ba6109dc488595200000008915bc38017bd6d80ddd45673a15ecfaddfc845ca661aa787b6c4abd96abf53d40000000dc93a11dfdc3e98be30521e7b94c697f126faf9af1f9a7ba52fd448ba3ea3d4c5b74aaebad7819e29de98000ab4b31558fa9e481a051e567b7e656e9f1243838 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2944 2004 iexplore.exe 28 PID 2004 wrote to memory of 2944 2004 iexplore.exe 28 PID 2004 wrote to memory of 2944 2004 iexplore.exe 28 PID 2004 wrote to memory of 2944 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9111f4450cde40ae75a2f41f92670cd4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8d34f17e6818ee58979a037a05302d
SHA1aab80e33c97b78c8a2cf750f7a72da3d9c6854cd
SHA2567ae0cd7fa34c7486e52c0f8a7192d0153937562688aeb8846b9851e6b3335b7f
SHA512081374cd33bfbe2831d11142ca26cfd9eeab8984858513fbab8bf2cb2711b85e08e5b55fc3c55cc0c6fe386e72e4e0c72233974a494904dfd0bd665d4944818a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a87f392966aafe6abdc79c0a0c12670
SHA11d72c2f26eb292aad80c5f1bada9689705c6a2fb
SHA2563775862fc4308980c0b1f1c2411fe0376d23760eb94749142e7adfd952b60c82
SHA512580879b7138477f3e5958c36bcf78de07cb7045753b0a2c87f8836ad143a570e41e02360b41bed5460a0ff7da0817eb81fa6981adf6277cef2aa0b4760300330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51210b485178010866942fccd62d09d98
SHA1ed4d49bd92bfa45cca260e4b1d25555e5792ab90
SHA2562bfa6323e19b47f2f8c9e899b425c8fdc47967300b3c125cf40c0ab7ee18f5d4
SHA512438d089cf8336716cd96f94cfc218898e20a95ad79298426c2f2b1ac71c5db7baf52fc554f374835752ef8291e3b9cfb644decfb10043b48b98b3445861d1e9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb51f453414ecb4279dcb8632aef40d7
SHA140f3aa1c46635bdf87291f8c8b60369eaf5f4fae
SHA256415caa7f8a1af207dcc4717eb102a1cd8d9f5a9945680169da6a6aedb49085bc
SHA5128ef4a3b3ca00295466a4c99dd68c7189ee902c646e095e8bfe187102394c7585d5395193e3c657c26d5c55441e3f1fa4d4518510297cc2ba929095b38d63030e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b65d70a461211f69a58136da0a17f80e
SHA11648cebeae1fc555d613ebc4129dedad8caff361
SHA2561260f7d32b2a394ed371c88099dc33702c343d35ae7676eaa2d07a8c2f912032
SHA51250cdb1e56e19f9a77e0847783b0df45b3ad421084928247ae0888deba9330abdc83cda01f4174ddb43dedccf3901537928c430ee0c1435c451d70295d6efd820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54adb78eeb8eb73ea44d1446e8ec127c8
SHA1230f7a24fec928223e63ccdd71001fed87d20668
SHA256c29f9a415c73a4e19ce9af4e8f900904414f9336d915cbab400ba75906c0016e
SHA5124b3f4b681a2bba7f7352d57dfae4ea433f735957337348909ed92a3dba58e08e4413f53e8f6586584c0c551bfe68abb7d2621dd71819c93de593ad7a15326e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5b422387db07f6e5b9600f93515948a
SHA18b72d0a11ea76fbec708670bdc5b00afa61ee8a1
SHA256c3a13be220b20c4282911ab60fc9ba26e2af8a14762a0f2d266d58627d1bb0ca
SHA512bf234172011928bffe1ec6f260c51d897e830a2e194e3c7c12e577ccb4cd32dcd7a263b4518e70a429a826d9a5097a8a6f2a6d129e8ecaea4edc3a6458e68b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569a355c2ea6e83a7f615cac380589590
SHA1dba81d14fc236b4dca1baed90a570bf7437ff0c5
SHA25693bc77136cf1b81873953e12eaf75dec068891fbcb65484e05f2704e20ebc66d
SHA512a2918a0121d4ff3beace502affe2083748695691e49d464825e5712bf8e5fb2a49df46221b9d14e463c6fbb1d5505048b08f72d7041b268ee9b2a82e644570b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb78b8ad606588a09428506f83708e21
SHA1bf396a5a00ed54997d789146f51059315302f158
SHA25678fca67994ad44823b0653dedb6df360fcc112be2964a8d0735539f41f5f1cc8
SHA512c3288e7baca6726e8f6e50fc3de149b9953ccb0a119289d7977ff701bff34fa39ed3be70e4e183060e9b36848ed7da1a5ff9ad558a2d9f03118e531bcf6d19d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526a0cfaa800fd8ffa2499c52e0ee7bd4
SHA1b2bab8eef90ccabeace17bbbadff68d13cc5ab1e
SHA256ded3bc0c8b5d804274c8c8fb628c53b95e5bd8cf7080d285f0eae3dcd8ec5cc7
SHA51295fe394e6fa3197fdbce9e6d85af3bff9075a671437e0a8668927f428a3b7b627ffe894e3e750237efe5fa534e31366db75a0d76e877ce173d6276a3c82e3b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b29c8feca043375802e958ea0d699c8a
SHA1ca579e1a658f37b5e118969d9c367a6425e536a6
SHA256e436387fce29bf36bd00addd5c9d75230529ee26074f079341a1b5a134222825
SHA512f8d86f90cc1289a17c4b1bdeb753861b0055b435405700b0ded1eca5fdd291995b582ea00877334f37bae02ad13d03c690cebf147071aac9c9820c651f5be10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2281a16951bcdaeb4bfcb716a60b353
SHA1d70765d46ebfa2c5269d36397e3db8e214364bfc
SHA256c31825f939146d18211d5f566209fe242f489ccf201680c18bf07aaa6bd2b75e
SHA512f33ab225d15d7c56c0697f3c27a6db0c631872b2fb69bd1ee72fd42ed38a3cfe9315ebc0736d5a5d50c79b64870c72dbae10c12572c157815c5e1ceaff64f339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546b599cd2b6297726d610f62d2a2f409
SHA18916ec7ccbf1bfb35b4f1bea2d58394f94823853
SHA256ac46f190c8eed13ece4f1a3574e7d5e3e6f6c16ec908e6a2082f79a3cf066e81
SHA512e9a1560772f047f5ff2669cfdaa79ad27438758833d4c39f7506cbd6c1374dd5163a461a5e8a63e4cedc53aff119690066295788d6a20cb1a39e3521060b0ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a96afc00eb1a158d803147ff5ae51114
SHA12ad7fa7365b892088665156c69b3ac24b79fc5f6
SHA25617bc2076f5b029eb02a3f828329274e85f5e0bf846a4613edfe29231f9bfc2f4
SHA512ef2ba960703e07054daddb8d0d5a654c90a68248118ebe9950ad7600563cd86674d793dfe99582a5d14df0cbc9771d5ca85c9f8bc296b046d3ad2777f1b6048c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f52dc4abc30624fdaeb41b9305e618d
SHA13364b73ae950659da74ebd43d1a87bdf2f6f3674
SHA256357116c4da0c318ad9b7cce2e132d8ed8ff85b1bde664c867960699d554d81d4
SHA512a9eb1e1fff863745d35f977aacf2d2509b901b2e7307d3497c6eefaef2748282a031a2c326be9bd3188fca59c17dbc05c2d4d6b405872d48bfbb1e02feb8a14e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5610161fd01a0eb05ef865f036e7c1831
SHA100d19357bc2fe7fb28c8b1f6f8566f9fe73ac8dc
SHA2560c28dde8c8f72018032e6e4d607e715d76202546453c6d2dc5d79dcc9e2cde18
SHA51279ef854d6173d28bd51de042b7821a8c8614a0c966310d6d191d8a544bc2a8d591ea4ae571b33e0665e027a243fa45d7744b6afbadf12c11a42a8230309b474b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547f4732c69d65f86bb2b9edad914f273
SHA154e9890c3aae283ace5cd52f6ea98c6e1420c1e1
SHA2569d8f59e2458b2194111f84bf3ecda7aebc3b04a80e993c460613905883045d70
SHA512bd79b856d5eec174a0c5975dcb3649d9ecf85e84f0899829344354a8a1bffea40720dc997525dbd4cb9cc9700487441f53d91ffd44b8e6197377c646669ca097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5332620092c49f4098206e5da3095ad9a
SHA157a3c5e398629c4a9aa9d13770de1a8999bee7bd
SHA256d880d38f4f71a39f97febb08c5acc68d89c3a82f43bcab41aec4f1fa4a01ec0a
SHA512904ca9911d8ce6a853c534e718bcdcff0f58dec33b00aacc3fd0283344b2ee433021619a5f4e164374c01b4acdef46f305042f187c06b71b2335992efd0a6212
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b