Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
93565782dd12c10889f152e6ed7085cd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
93565782dd12c10889f152e6ed7085cd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
93565782dd12c10889f152e6ed7085cd_JaffaCakes118.html
-
Size
804B
-
MD5
93565782dd12c10889f152e6ed7085cd
-
SHA1
bffadb190fe51a691fd8ad3d1c4365d4b3784055
-
SHA256
11a9c928f6f548b36915e8495613717eaa5f5aa3576d5523ca4ef05584ec701b
-
SHA512
72fee254e6557d5230a40642a8f50bc05b7242bef1704d15a110038c4b6f02d7f97e85fff04623037f3a17ae14b7d530798a63b982fd4aa85d99abff687abf5e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77E44951-2215-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423627976" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c11132934af9f46b1254c1545f8e59300000000020000000000106600000001000020000000b4769b271e26b8180e985604c03fffa1c5e7117f2f346b3e7d561854dac0b48e000000000e800000000200002000000064868b84d849a58e94ccca26ae1369a1e79d12de5f37c92b4b9a77a3a3f1953990000000c4143b9b5b0eda79e260ff14e989583f3245886e22d5a179a0e17ea6a75ada8fd4d95c62fb6f9c4ccadbd90f3bca760fa0d28452838585ae3269144365d7c2f7138ed85510751e2a7b9ac1ff5f60a1c6b2d6fd223008eb0b9fe6f49767818417af798dae2d879fcafc3fc83c42781f3822aae7e0e76d235150ef5c9ec2296a5ec436423bff5374459c89dfcdc624e188400000009b403db4062ba305cae1c645cd5ee09325fc6cee3500499537457d6d614710ad6ed3662e61f1ff7a2bdf641228a45467d2f7c8aa3b936a388aebe04fb35c77ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2027713d22b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c11132934af9f46b1254c1545f8e593000000000200000000001066000000010000200000006c119cae4310921e1e3ef35c41bfafd4aefd0e85d1f1d5b4cde7a7336719de8b000000000e8000000002000020000000593c1b5e4a6b0650a317c0cd54fcaa18fc8138cc1437b190bb561e064095f334200000001a9ab8ec6404f8796245aa4273abf0e455b8ac048cbac22087fe5bc17a7f2164400000003d1aa34d1c2a60e5eabc72069b3675db3f6cd38c873b749b4c50102bdb6972eb4ec18b7c3d6687ee31975d61414856d277236a025903437b6e403f2e7a2c19d9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93565782dd12c10889f152e6ed7085cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ac55a888558855200f46a7eed8989a2
SHA185b61e1ed097da5327880e6dadf50bf77b434594
SHA256f5d3ac00850512a19740e1ef9991aa0975707d095d94b443e5dc14328da819e4
SHA512c3e1ab5aed97f53c8ffcced621252491e4c647951e599ddfbc1f5956da89c17f245d2d68c98c05ca06595d52b56ac4ea10297cc6f4d04f11932a8b9832d17ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1b2ce01e7e9a301f2704e6a69a56f4a
SHA1584b004c6ff8944e3268b09da9bacb44a58bb5a5
SHA2565a1e2bc6bf69c9f7a7ca7be960f31df29909cd36bc97ac58e5b7b70de664e097
SHA512e98eb96250cbec70c5144bab19fd55c9cc623448a279d9122fba97b2840dfbccb6053b8ea0d487ef02ff1a037616878c3bd38ff7847c01e054874f923f38d87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea5d69b28efc383532fc1bf077c20ecd
SHA172b62e1bd2b96a720dcedfee4b5f643a2696c842
SHA25631fe4c70787e0af695082181daa608d628b528eb015a5c85b5c4af086a498c58
SHA51220109308464dd0348db79e9c5e2d85e1c566a261fe21ecd8966c9815abbf34b6355f7b424ca5e254bb09db64613a3808eca6267ae1b37f588374773deb8ba7fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567ba560f6872e03a7c9a79a424139726
SHA1b1c58ee956d206cd778bebbc9c2f4b0b082402aa
SHA256a085c86ddc2d253d07b8c3fb710b793d485f3756f1fe2b39a881c701b961913e
SHA512389afabbfe9ec0f9580c57a5826f687f93a9895015d8b152d2250f5909b38cedeb3bd86111d58f935dfb054200fc990f4abe7a10d8a48368d6eda6aaecc33112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1a68f03b4ae0dee926a70cb9b25c70b
SHA1c5fd9107bdea5c91e2b4d91030e450a216406112
SHA25642c35fa9b23c2bca724ae43101b28d981114a7c27d63830605eb9685d75860ee
SHA5127d6ebd2619fd438df638d84715b5c2fa30497a0c9db8ac7ed4b37e2d22505f3471947806008a98b56336014db8ea2d73e40e979c8aed6b0a6475ac3743332a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552593fa5c149ff3cf560a7d52b32423d
SHA17906e7c9dd2553256327691e761c7eaa878030db
SHA25630345c100c8b823a0ebf889d7220907d99d28398b98950edf7d485b2dc94fdac
SHA512e507b9eaa79afd81a21e1f2eb315c567a5616d14e0c4a877b953758efcb92844dd9dab49e027ca0baa0df4f4db9e76620e6be9bff6cde25217cb4b3350286bc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fade5c7d52560ec3981bb04b1bee9a4
SHA17b11a99e3df38d7cbba329eb4d3cffff9bd04099
SHA25626a815c18d5f34d768de42bba7da5bdc4d39bb2aa1a7a2917d2c35aa6cd92084
SHA512af012ac13bd2676972d9c865584f3036cc4941f61da4f225779212d15b9d0a9f5194028240873b30cbedebe7bf213b1400fe1b4781ab0e52f4135a4f9232d30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c5103c701f51c37fdc5cfc3a1eaa91
SHA10b8ea240444cdbcaa7bc7289d74bb2f796f76038
SHA256e250908d4a547d300462a92d627de41d6a5f86755bce4bd9e403c592b045c58c
SHA512155a7a806e8868b7c84ad81d77ce9b7dcd7feb1f9312a7ac14cad8de016ddc0aa9d3d0b9c6e0c052061ea06622d9ba2c3324221e678c31eb4f5299c32835d9ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f607d335a9f190dc94d6fe7d392fcd6
SHA12a5f01b53345d3ca5d4804f7e05f6eb44ba7b1c8
SHA256c6ebf0bc262f8f3a34858189c2ce4dad54ab754dea7045822a7247a7dca4751d
SHA5124098a2b4b3c5a24fa0f1128152d9fc8732b39fdc0282307633a09051dc747d5b58a8049acc53d2fc13b89d358a6ae715c7b6d3dd4022736f94bdc3f68701d188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d02630172d0c68da669b6f73e1fbd31
SHA168c52a92a4eb8d0321beb2349c701b94a6db2b90
SHA2565eee9511c88aee4fe4503a0c6eef12aedc7a2459f666aaa72035ad9fd9fda1a4
SHA5125da39e1cc540c3ee6c4b5d9f2c78606ec3734997801c27b9947b3082a0054219ba6e2846cee7ddf0a6e6ac4e63e9efccb776d211b5d4b17492b18578df2c81ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d467f1125600b0a5dcda1bbc8fab71d4
SHA19603387ddb295b1ff8c6c9e6879d54135f198301
SHA25616607279509f846323f005e19fd995cc3e16b1a8f24e1c21981fc4a72bf7e7b7
SHA512d6fc7f910b467c799b38b67cd11584ddf512557c795768ffd8a34a6179e61c806c580a0efedcf6ae06d72096d6ef684c9d0a15d8b47f5b1d364a950878aab0d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9d92584668507d5b328777e5b3fa8de
SHA1314b6fa4486d6469409c087123cf78186f30faca
SHA256b5f7a4574c014a1e49ec2a656e925b80da59d4d4ac607788f147445854eb6e71
SHA5127f6e3bf4229099d681dfe7043aae67837a70dcf5ed2a736b3706fb2eab1fccd0ec83923c252bc82398bda30f853d679d38bebfa1206a85a098b71cb84f0560db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be2377a36d2552900c984fd7953b8d44
SHA1169bfe5166e2f986a0cbc1fe9041f9c8f26f887c
SHA256ee02bde28cc75818c70e375e1db37deadc0c678068b2455fbcdbfb30edcd66cd
SHA5129e99701ea91c68a823c22d5ade5d424f8ad5d11cb31873ab2c902df0dcb7ba5e6e51db1e07394aca43cb4516ab33e690d037e3c74c390836874a0e5f2729bcff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4a4f750373415baec74e252ec868b9b
SHA179e07087a19d263c967ab08c3a824fcf80ed915c
SHA256b55f1543400d337d5c78d2865855113480fd7f0f57c38170dfde114a49976119
SHA51290419d8db9d04209651400f74eed773c32500561f847877c80e3ff7e96c956fa8e4e3e9e6c97305f1c1451a3c0484c7b5fae1642a177a990f7169409b19ebdb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c497bf52bf8c5f538f0f9db764f871f5
SHA164ab01525fb3b17c3da4e1afa2a006794132b4ed
SHA256694e068cdba4d1ce2dbc5bbc0a2dc85b422546cd80969010609ad5b258e32245
SHA5127f66b1c7bf9ce398bfcdb25da0f5988de7bc0b3f1be8aef6c6754eb99b0439876566b91a21cbb249ba398f738b6710606cd12c935621495d29abcac88af253df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fefcecc841c2dcc3e79523d7b929a3b3
SHA14bb25ac61bbc703c9329378288e19d7b074cfcd8
SHA256bb4acb293d6c77dc0e1f4254b0d344e48f504fa5153f4b42e734ccde2d92832b
SHA5123c6a7cfe7f80b1559b4c1932df9277a6a33fd4fc894dbe6206bec1cc5ae4e909e726a1800df19d708ed7aa4b5dca0043044ca698dcabe28598a6373d1b2a841f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5933ad1e2461838f66b3a8d7f44403fa8
SHA1934bca90c0f04b9bd6cc793e9a7653e158c56f99
SHA2568a9850924f750db0a4362679b3ae47e35e485a7729e8459ceed646e057d5e6f7
SHA51227446e3515eb00e70394708f201ee3d0a9c54692aa1889932ee6fd5f582fad3207cd072991156deba7eda9ffb0dd898d53d3e958877f9fc6b21e183d88b799e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb91e293ea2c428c192fc60ae9356223
SHA1692245c3f28d411f1ddae64ff64547a917dba6ad
SHA2564019f2dc288ce335572eb7f12bd04d50effe6aceeef98ebd820ca0cc33c77aac
SHA51297f9b26db6b55098cbf53a66fbb19aa727548c1ec9de8880cbc3e88efa86c833f20a7a4dd3ed120a3ddbd8988e344b6eecd77e52aae03a7c7b8fc135ca02e76a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b