Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
9148a83ebbc9105defaaca0e2f37d2f5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9148a83ebbc9105defaaca0e2f37d2f5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9148a83ebbc9105defaaca0e2f37d2f5_JaffaCakes118.html
-
Size
459KB
-
MD5
9148a83ebbc9105defaaca0e2f37d2f5
-
SHA1
ef19015b8b7e83faac88ec4b4c377ff75d3fec15
-
SHA256
5604402e11f433470249bdbde27af15dfc2cff74d44001643d3b442564a339e9
-
SHA512
9ead76f95136ba0c2578c8ff0b026962aed5caac2d15b91d277ff5f8ebea027aa6242cca595fd9e5ead28b20501cae64aeb6eba38579dc6cfad05e6fe1865258
-
SSDEEP
6144:S0sMYod+X3oI+YlsMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3b5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082db810be0e12c4bb7ba3829a47066aa000000000200000000001066000000010000200000009caddbcfdfdfea5c4eec6f49f1fc088033f631e2e85a3da44464c6f5511f287f000000000e800000000200002000000087979b5534e797da87683331d2a88adb5e1ef88bea84bfd0110208298081005320000000ecd4a655a12bdd15249d8bea35514522989e83d0a39da710fec866b19c6631c840000000adea4a8a84159cb4960e150ad1358ae35293162419abb973a8e2c85808818aafa0fc6431e2119d004aa1a72fc8421df9b912aeacbfb42a2c29d6907f90983b46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6064ea7698b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082db810be0e12c4bb7ba3829a47066aa00000000020000000000106600000001000020000000bbce8acc5ac97be92532437f2511f2496df1dd4d358857403a14786556fd53ed000000000e80000000020000200000002fa82e27a3324882c4f561d1df9098e04c0288e2e51b7f2ba65a5be64ffddee5900000006fd4a079a34562e59a40ce52ed0c622aa7f76f60a932051fabdcd1095c590808491e801eb92528a0eb11eca586c4df45e4f6823c4675ff344788c32052e8045f11665170d85a0463f55113761f7a25b88aec96308a42868e03f262afc5f7290985ad1b55b719d2affaa2a27a0b56c35d69b48ead00a6d80f2798743bdfcafa2e400c2b0cf85bb0648dc1fa64ce6e8db1400000002ead50d981149066298581099075a48fe846b14e96b0ad32ddc8960bfaa104fcaa7ca51c83dc81caa372c1443bdc10d747f9539ce959496ddb25f1ced566b95c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423568769" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E6310F1-218B-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 iexplore.exe 1912 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2492 1912 iexplore.exe 28 PID 1912 wrote to memory of 2492 1912 iexplore.exe 28 PID 1912 wrote to memory of 2492 1912 iexplore.exe 28 PID 1912 wrote to memory of 2492 1912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9148a83ebbc9105defaaca0e2f37d2f5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a208000fdf00841a0297bfe3ce4b8c30
SHA126126724c8ec3d6be32702508804f258f2b213bd
SHA256bb68f3fdb068e5c8389866cde0ef17eb7fe9fca79b529ec0b0d4cb27bf32a9bf
SHA512536ad0b13a411bf2a7cd10a6704a27c2f6086037ce16f2d47e38751f1f6c449ff183977d37d6b7b668e4507ebefecc5107d7664ac12570950ccdd35e588896a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac5fa2fff20a0fe685131046e898eb3f
SHA1a15ca96b982c3b393df678f11e3ebb9a17caf52f
SHA2563376701fd808b08518f6325092786a569dc3487c6e9a8192f61cd6e08604a9cd
SHA512e699706c1997620e196ccd53dfcd6099c87398fecaa9d4d192326a971302693aa1b092ceda9052685b5620c0d26db5378f76260b1811b0c6cd75f770121b6875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f2e7564905222979bfeb02bcbe7e76d
SHA1bd47aed54dcdb39c633847ea71fca3b035fcd682
SHA2568facd495a32e6fc771fe3e5955caaa3fd5b26937bf0f9770a61c5a4e61f79141
SHA5128d5c8e40c5f6a598df41828b260ded6407ed28604835286a31cf8d9604ba8a5747b5872cd58fae9ba11f2d8d1217480904d65f264a56aae5187f14f10d0fde6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc25c1da0709f44d215d9b41c8700a85
SHA1dd855f18f2eab18777b36729ef2c904685290883
SHA256b23f1ea40e94684f6da5100504c7ffb3f011f4bd6f98042caf7aa1740791cb97
SHA51288d4abe91ca1c0ee1fdf02f2d0c4ba0826fe8aaab6491adfece18002e7e927830f5e794a93bfa373a27ee5beb235c59ac982b154cc3f1fd1a3bcd347c015c525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554bef8057c69d3e46dca7821fc14b7ba
SHA1b507db4b03e6775634ad84b0104e3bf8d3dac687
SHA2560efe6627a53075c8d12f1e4f57fc96229cf65b5d815818479e68f27c844b073a
SHA512c1ed2986a29319dc8c872ba19b8f3f597656ccfae4ef35d0ea03e19745dd1e843c52b2620655f2ad9659757eaaf1ef103eaafe260e8e6ecd1d63031c9cd04b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52429c958e3d975370c7dbbc4e5b3c095
SHA1e2a25eb98387526c09f44370784cf5f2fd5468c8
SHA256f9c16586ff3a8088dd5db0d3a5fb8997ad6ddf4b0eba2aac235d99925191750e
SHA51231efe0a956f11359c7accf5750c038cdc441f0ac77aae6a73b75be3197a2ca5b044dd1a071ac27288039ab7c287bd7e1567cc6fe2deaa829f2511f6b2b36675f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b53a541316e42c86882a320d811462f4
SHA198ab8cf686ad4e0b36ecce55dd84f555bc7e6dc2
SHA2568e656f6b05bfb9864a7a4d7703d1a38de02989ceea04c40a7dc2c3799a9884d3
SHA5120dff277e4f9e46763f761a25d90b74ae9da0c68a0d756d840636749084669be16923fe0403312442500936af3caa5639bd21f5dce9570fb9df4cdc2b29673e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561df86eaf20c62cc7adc0675d4a633f9
SHA147793663f64ce1173caa05a78521e6b374cb5fd6
SHA25616d78c4fbc052086a5224011d0c947bc0a15bc064433ee24fd878c27331d7b99
SHA512ee3654f2890970e2131fd03e457ef578703ed872f7fe3e87f161d2100e589890ece6bb3fb9bc0f4ef6166e8b8e88ac33ac7ff72eb2c05213dba6abb95ccca14c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8f5e92a3fb45e637553432dce2c7d37
SHA10b70b1dbc5cc446ce21ba9239c7e1cf974ee25bb
SHA256dc87d2761840d32e5f3c445e5a22e5b7b21f2d0393033d260ab9040586ae9f24
SHA5126edc30574442445ac91211c1b35d9d5546804b8ddc51bbf6b1dc2f01cf2a0d4b264ea4b782c06d29e78f16cc95d574576e81b7e6f3c89d31ba2837831ded3358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504c0d10f9a07fc4b5e0f2e5b8991284e
SHA112d8d05ce32c971614b4fc3e1f76610c162ad02f
SHA256568accab91cc3d102df5753550fca1549fac7b1eed06090e6a3f076d0b2ffee3
SHA5123cc1c21b8704453b4490b34b079f8a81721ab485aa32be3c999dd25621ad8f30d47e5a43c227d8b75465e5b31e8422bb44a2c8af499ea2cebaa48b5bb93dae02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4bc675bd60b73191225843a508f100
SHA107a72d19a8ecada58784b35aba20a02d789beaee
SHA256df2eeb9db088aaed8340ab5124b252b607de6fd673d320d73e02979c7054cd30
SHA512d3fa171be20f74722ac50a1a72d161ad0eec31313bceaf26883f669f5c9b5424cba50b1ed85f638d6a56cdfa5f5847b941b5c65232a1cc35586bfeadbfaa4398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7f07c985300dc128b3a5f82c1897494
SHA1d18d8fc7f2c59a2e50db3a268578004888294fbf
SHA2568f3d9b70618351b1dc0d73455f1173e076144d6192d124229eaf4b7505cdf188
SHA512afee55fb0ac51a9704db94cf7847b561aa9c85336e7486c02f5a40123beb19a2deda32e9a9eec7a06a954ba5e764d9b571daf2178c17471a18b94f1b16d88e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebde64342e60ff86b3ee697c10c4e633
SHA175248b634e2622fe22bd9e75cc57332552bd22d4
SHA25615ca23732864059855dd8e55619e00baaf79b0f55a9d4421f80d0ce9e221d83d
SHA512c42d56807d31f2f53953146acf11fd388d4b7f3fe1601901cbc024484e366b20bdbf589fd69cadabe36aa39874f78da0893e7f7cf4981178a785181fa47dc843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e32af25b9b28bfd9036e05e96f25ab02
SHA169626e997a444ae9614387c5b15dc0cae28ce9ad
SHA256116ec237d0e8e7f68906b01e81980391c1e02efc13360406afb40d06ebd94cc8
SHA51285a0b447cf69daa6f6f5f291b42155e92b6d76463df2a6f15ee95e7b58b4fa693ed69e7b14fa2eb3214b3c31135948474b014d169f61a23cee4101c7fb608aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574ba7f02785f9d9ba672b0bf103d212d
SHA1ad8e92c68c90565c22f875013cf6c546e9e69b8e
SHA2561e762a89148cd1509921e605fc5d2f98e3d5389bb62a54b4585ea9e669a6ce5e
SHA512e6d37bbf4d2d653d11c9757c0688e5d07ea7e8f107a73130ee7af967fc739acca7d1f3812b5ecf508a38274c44271df63c4ec2f122a7ab559b3dbaf4f3056bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5723464d23a7f787c006b2677c31b3d67
SHA197aa58d9a991df31c210f0fc33f7dde7b680c53d
SHA2564d6271c69b66099e2a0b6926c0f96523a355605f65885ccef2d93cd0f32a2935
SHA5129b6f37cf69ceacd7b056e86a8c449e4a13e6498f185d7e30cebfdbdd1a1edc74ac87ebf05fef9c2267c33ecd6e2da355210deaca896d71e59ef0c071dc01609a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53663626aad9d6b938e2ffb45a9e64fac
SHA120354460f3c3109369e18801f40b5e8e6bbba06f
SHA2564fcd25bf7531e28f0df9c2134dc405990cd2515480a11da51fb994307e1f7502
SHA5121232cdb8444794fac8472f558ccdfa58f920521445a2567300a00c2c94e36f816dce21b81f9eafc002d097edc83b807feb5a5d6bc1971a7777ea412a3da8c64a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0d2294524e61ce2191d675e96634191
SHA1d33bc2afef618078b7efdd15c833730016adb88d
SHA25683a308d98a310d847d5228211d25f360a0fef3b3f7f39c54518b1fba7901a6fd
SHA512431da579764f1ce52520e476da19eac10ce0dec48eb559799912df21044499cf3166379e415414c2507240204ad5f0dcd6e05c20d666ac7870095de2543dc744
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b