Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
931aabe4cac6fd63490da48bc66ac320_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
931aabe4cac6fd63490da48bc66ac320_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
931aabe4cac6fd63490da48bc66ac320_JaffaCakes118.html
-
Size
189KB
-
MD5
931aabe4cac6fd63490da48bc66ac320
-
SHA1
cffc4f8d3801e9abea56c8bfdeb5a5a158d9f850
-
SHA256
9f340c3159f527b3aabaa2f970cb06ee993fed09cf6ad2862557b87c29b1c505
-
SHA512
e379f8b1a138a576303379e8a80115ffcbde29d9cbedb4c600de7f4b4796b1b77cf998a5015904315d7fef3c184f1b037388b16646896e454e7728de8d0e8eb9
-
SSDEEP
3072:Zm0yfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:GsMYod+X3oI+YS1tA8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09417e514b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423622218" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000baaa97828f37e448a2e5075db884fd7200000000020000000000106600000001000020000000d0e5bfb08fbe6ae45f3e280da47f90e0fdd043119a135766aec07078455dcf75000000000e800000000200002000000012b3d8c5d5fb03a31d595a44257a87a67c77ea2524934c35649e658021143b3c200000003b78045547a40ad35cf172d4153ce48c9e852fd4a792c636c186d961e5114eca4000000013765bbe6bea43d0657f6b93409095b8a8069b10a0dd0260dda709b3cd9e604af546707c908282c80a45f77e2c225cd41dcb4bb8e65f524f58ee6fc0ae7f2674 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000baaa97828f37e448a2e5075db884fd7200000000020000000000106600000001000020000000420bc5bfe6792f5320e1c7e3eef9c19c7475fd05e358074870d4e3102b0f456b000000000e8000000002000020000000a8d46fc45684919fd2bc7c7fac013c4ffe0a3d3b864c62ce72aba9c25372dc089000000028048dcfab06d922d7aa51f9c6c26223178491e10f0b9f9f1b5f266f8d1305184983ccd156d7c75c9a30f80cdd4d7da62f8e23f4156cd10699ec214dcc29b612a09b1b5f51017dc6395f2943f2ace5b17e1abd830b7e0ad3a5fed30553237a1236f1361c294e48b4c61e9f1f42b8ad68826189f54045f9371877605af0748a7cb77b3471b92acfddc4a2d7916c9277c74000000033e92924e16717e40c27558ab13559592377998f8a4b390f6ba189a9fee487be9af75bc7af0788ac42ebe20188454b73bc914580763769c560e2301e6d88f4d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FF82C61-2208-11EF-8C27-FA5112F1BCBF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1548 iexplore.exe 1548 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2564 1548 iexplore.exe 28 PID 1548 wrote to memory of 2564 1548 iexplore.exe 28 PID 1548 wrote to memory of 2564 1548 iexplore.exe 28 PID 1548 wrote to memory of 2564 1548 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\931aabe4cac6fd63490da48bc66ac320_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3457d548cbf4a9106c2fa8e580a08d4
SHA1d858e3920d5cfbe62c8cd8e57deba7586b6f6983
SHA256fed8693e16cb98a7f0fac87939791ee671ee243c82a8ff95c9debcca4f4614c1
SHA512b71a3ffbfeca8437fa33ac8ad629c4752be755cd971c464e9063771eb579ed9145c4d7848d6727c0fb098cea8627f4306d48bb90acc35820b561741ad68c11bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d592db608da02df405b81752be82a48
SHA115a736f5f2564fc10345f46e9c04f41d183d33dd
SHA25658b2cd5cfab6b283c34b5f912ec81a6d665f425a2aa0275207e98dffeccb175f
SHA512755040e04d38a13216a1a2bed8a3d8ebf59e98efa6445da8435b90553ad2522b370b8c82be15d9a38bcca59b972d8e63c02e6c8c1cca4bed3cc332a7b21f7281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ebb7647e102a335cdbaefcaec45cf16
SHA1ae255585db634725bb600f6f91d64ef8ef46fd18
SHA25695f1bbe2a8470770ae1c8b2625f45879a0ee2cd9e272762cf75e0532ecb2ef76
SHA512e10a0987e9fbe0e1a59d5e9037cea98afa665ae4c6ca34c9bb7b763a0f7f6bf7a915fbc62fe2158d6312ff0e26a506cabc984d286a6613a31149869824761324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dc6315df656c8eaf07c49c2bd8e0c79
SHA1cd319b5d855449ceb1ebfc5721ba66066cb08614
SHA256c28187003de3f0d5601fe69cc1ac96d6ddedd1c1e63d99da4f0ce13351ea555f
SHA512dffc8456dea3a41d793e88d905ab4354dcdaad33c878f665c41c652afd36d87c6261495fc6161f0c07699925fd6c7bac1dd9b3f5154a47d87f46ef0be84c5d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d347726531f3f8d541c5ead4f08bece6
SHA1852c6fdae4453802c04b3335254d74385cbc5807
SHA256b9e5d6c931824761ccfc22c798815310ac81a6fdd9d647e5d50e717db7215383
SHA5121a2482a5c567d51a2d04e7c07d7f504f1a07e558789f92e3934d2ab82264547adbc77a75b7ca0bab002f8c76c78ac831b67a5c57da407a2ebd1d9f3ed26f9371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef72c3ec6d82256279db271715623ffb
SHA1d96239ebcce06f636dda2667941814a190762773
SHA256eb916aa0351cdfe082aef4235569746262cf6c2962d0b54f090e03ddd927f5b0
SHA5129f0f38b17b5a1d4231a5bec4b871e0dbc6b080f205cdb7f8b2b58b9b4db2321ea3558491aacd9c82189100483da74370ec71b9a9482a35f18e676b2e8637247d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a2d377beabb63df3780116a728022d8
SHA1be59f3213aba77aface3ba3ac2d0b85f6da6d144
SHA25608d0534b1bfe58c0c3cb6d01c469a055e7b62056dfb5eb2352091aa09393a91b
SHA512c06167d07f54ecb7ceba8aa108400c452c5c88a05fd25a8af20fc3974571ee953831af07df22865f31fb402cf13293d97747f0818fcde14ece3a212691b4a46d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acf8206931d71524a33067a866836aec
SHA111da80b4c368b10373782d821f8705d0e2de4dba
SHA25679086e7c751017587387371e856a2de79d800c1bf571d871dc28747f1969e045
SHA512f1a9e0bd8456a909fa010e36302c8d592bdffb66bd99277ec4f6560e72473a0997b76dc8190f5bfeb3fa509125243125142b83f5dae517f2c7ffb88a6eab25e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b28d7af5d888318c54bfa1a182842f94
SHA1573329fef3f4f7849618e6e5b9fe0217c5e43993
SHA2565b43a4335cc68610cda86a2d32451a3727923eab7f63268b10584257f9251e3d
SHA512d3fb78f750957ceb4b55997d27e838c0daac21ff3370c739d45b757dc3822581cd649533bd932a89ca0a18d7b0caa53621dc3212ccaa16666f1e4aa0263204db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501d78bf9df36cf6582b427c6b1dc18cf
SHA19839359d7b54bc4e3eb1794b7a112050e6e476eb
SHA2560584a8b29818e8f62c1715a1d4f2c158d1ac3fd81eb17ce3ef4e0c29c0d75f31
SHA5123a435b4719f32e598aa4e9a8999528bfe5757ad778005ab3f8b2cb77b1f3aef1755c3c32b01980b37689c1596314d96f8480ee061502aab5758b28d20a1126a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8e0e3be09211bb939a19d195c54877b
SHA122b7d62748f6f64f6276a9bf60ed802f44590eb5
SHA25677dfe8f5ce32ba980cb8a14f2b24fb2002fcaccc3fa5b8a89743c005f93a5d8d
SHA51227d6f41cc5d9d7d361b38c28484982c1ab129e40a337794d8bf6819e935769f0c251e9dd01a69e8c08f55d3796d2f93163fdc971c32ab1c2204cc6801cd2d79d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5970613295fc4785287ae9b81c3904e4a
SHA11c1857efcc084150c09792612e533fe2967bf3c8
SHA256d00bd5f93acd553791e922a446a0ce008d119d87503b13b9dd7f5ca6c8d538a6
SHA512ca891d68f16024ef218acf9d0c8285c854da6f01c28b58971831b955dcfaa8ef1d57e1489344ff64a5a1acee765725033d3ee086ff6db0dfa16c8c4941d465aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5773ba023ae85bd3cc51cbf1ac850feae
SHA1edba0917a9a2c349170e7b5b614183cf6dc688e3
SHA256535925022a74a54b23584b670ecce939a9b2285b274638dea223310947c92256
SHA512f43c7b5aab1607409f74c905693d6339f19269bb84b67d622f98b5e92523876496d7cc9050c060cf69b632b053413d3ed5d9a7f75e7666a6dd1d8bebb4987d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556803c5fede8fd87760ecd9c97b1a4d8
SHA18890c033fd0bb5ba77da4d22173825a19e0514b4
SHA256ac8c7beb73241ce296a01717eb55abd928b457cd0a7d59f7b556a5529785ce8e
SHA512f5723e49c3f312af1ff69874c878c035529fbd4ff107ccc3b2d971b15a1c8c83a58ab278926b8864e3fca3ec683045331fcb897e1c9564dad133ad1637ba8909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eaf773c0cffd6e32d7ca1642cb5965b
SHA1a2e9ed4410f8ff5ed6d8db8aeedc9b8068007bed
SHA25654d0da71c0711292d63299241e9127af20351d9a5d4321aea263b7b66cbf93af
SHA5125d4d678f40332bc224068b1393cbfafff87085f8841ee595af94eb6a7c6d99f5ff0c8de024754c352235b5f0328c127b29ff35f5cdf44eb14e2cf0019e4f403b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c88818a31fea86927c18664a64e861d7
SHA192e425800b6dd2db45baac3b391e219a007fb329
SHA2566e41c48c1f8d1c295424fdb2a8523aeb1d8606116e4c88b4ec258b8f5deb0c40
SHA512ea1a616f84075c38f9011791435792755c601a4a89c3c009b8426b33e0f36209c79be5caed9221d5a5a526cae760793073272ec107ee77f7890562fcf88fae0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538aa5939ea775e857e56a28637d13e66
SHA134943d2a06e050d0104aae77230ef2266543ffd4
SHA256aa457a3dcf52552514252435a280fb80a903b2649280fe476315f320272aac6c
SHA512dba52a73df9cb0bd1d95c0e39987def644086f6d4c755badb709f2973db6556d50ff5b0031ed8e3cdd5154f5534ed5d298a0c8612c46bad826c00e6622aa867c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba1722d68e1e4cafc4e7f62cfd1d9550
SHA1fb50dd1c16b71262febd38f19fe64ad0f79eebc1
SHA256e0862b65eda8706744bbc716913d05a0814827137e565e9c8401981030dc904e
SHA512acdaa740bb57d04ba9f55712fe6b5fefff9cb830b85fca75f732e0dce05999b9a7e98178572a1474bc1ddcec1a46340708991224c1536e811117ff118d7bf193
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b