Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
93a3f95cc28a74f2433a5255cfa74601_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
93a3f95cc28a74f2433a5255cfa74601_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
93a3f95cc28a74f2433a5255cfa74601_JaffaCakes118.html
-
Size
1KB
-
MD5
93a3f95cc28a74f2433a5255cfa74601
-
SHA1
f591c3b8fe8f7f1ec75fff6890f24b703249696a
-
SHA256
f299e4de8de759f36424ab66d0b938d39ea5236941e5ee2424b7b7dd2d451603
-
SHA512
44f53332fe310a26e41d3eb33e3d1c47df2c2431bcda05ad403d87ca458c6befbc7ddbc2c8c646ceec699522f3ad59661dcebdcd5af613223612ff4fd47b7e65
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07bba6d39b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a37507e430e90f4ca854ae3c2da77f87000000000200000000001066000000010000200000008328633529665ca4d71ad248eb94274345c85484b8cba565bcd7cd73fddd7f42000000000e8000000002000020000000e65553b7b5a8acf24bbb70dd678f28b170fbd777a362183a91e780bd8a94cd2120000000f5ab0703e4d1a467964ddacde18e911cc7ad0f8fe160e21c0da692dec7b5d765400000006bf2ebc1a30e8289a7e7e74d646ad094c71f2f5b4785ff8d81cfd9e97f7fa554166e1985732483f2bac66ec57ffbb5cfea7637c2332c9273e2c89e74e99e4403 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423637867" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a37507e430e90f4ca854ae3c2da77f870000000002000000000010660000000100002000000014c5083c9faf0c8489850989e8da90ecc7b339cd9e47a534c064c26cbacb1ab7000000000e8000000002000020000000326568ac9d7649f67fc99fd7f82f1910d86a068f4104f0ca652bc0538b7ca308900000001dde6989d8e27634a8102a965cfbdfa2982e9b04f991262da6cb2f0e2db808617d26cabdd7dd46b9cf3a4f3de612709181ab5a700d86cacedc780155dfc7f907c5dc7100bb2e40a608311a705a510fb4ae8b62b9e31bde164356f1d668a15855a5f8a10dacf9e2aece71533183963eaf52ada21dfc1bf32a24408db8ec85f6739c8895b65f2bf230915c3c75aa971a5540000000b257899ca36ff1a3db639a46f65532b1c5f458012232b4c4b0ffdcee4e0989d81163cff62ec8d3c8f64af7c582707c3a3a12d735acd66576f3eeb53ce0915af6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80034CA1-222C-11EF-8554-DE288D05BF47} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2260 1724 iexplore.exe 28 PID 1724 wrote to memory of 2260 1724 iexplore.exe 28 PID 1724 wrote to memory of 2260 1724 iexplore.exe 28 PID 1724 wrote to memory of 2260 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93a3f95cc28a74f2433a5255cfa74601_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d85aecedd817cc260d890188a716ca39
SHA1a96a67b92abcba8157cf8d625a1073f9d48ba41d
SHA256fc6c22c1c6be782b517a7900544ec4e20e7eeea215b9545d24c34dd76e663703
SHA512874551404a283b5b52b8a3a96d627bb1f3d2c841bbc69cb131a2271075437506b599c593d80046dc7a88362252f660c220fb155fd61df069a362a232b50855cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561e15afbd4cd64ec155331102f1a7b00
SHA17fc4e2820536940ca7e576cea8a60ccfed642274
SHA25691401f67107f5b388f17a0f647f6ba44bd35cc16c8889f9781e9b721ab4a26ed
SHA5123875010480801a41d8c8308d129bcfab6be12ba04f1b73c495e16c044ff078a682a4bd969c72809dfa62bfd2ae7c5c5bf4a4e5542033a085c1ae877e5ac945a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cfdd0c1cdf5d0fe784c59972ff32b6d
SHA1aaeae5197b40fc2952f1897c80f1fad18c31a4a2
SHA256e4e5c957bbca11ed5b0b4563d813ab2f6788a9bab6eda6a11f742ff0fecc8050
SHA512cca0e7bd2144c13e842acaf3be2ae6f17663f30469f67865624df0874ff488d6b641aeed1d60def23d30a763041d3c5659615c896b9e8a54f2c82a991618f65c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb447c613de7d3c5b3756429f8c12c38
SHA19bb88001b21006f027c4faee9e940b1ba31dc157
SHA25638ef555870e434469368191d0a8d0ded2597e73e3e6b5507c99373bc5b0f6b1c
SHA5129b9b0a9a8af0a17aeec75c03740e3bff50e9017c44dbb1ed68f8460a5670cbd107ed5c9927263cda5a2d5bff70ba765fc3ef45525d10bc27f18e161664248a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b861911fa9f7a60bfe03780a8b79bf1
SHA17844daacad0f216d715b018ebd62ebbb63b1e075
SHA256cf31b2900a580a37ac6a7018554c6521203596b67189f0a47a1d76997115d623
SHA51298ff5c548fe631b407ff9d605ec4392be759b8ab3ed471b1fc41c70b7e8f04b7d38fbe23b9085d1259baf0b171894621a3f2e9c9c96910f6979bb3c955cc88d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e5752c5313f1bf55bdac7126cd1f441
SHA14f743e8ffc2d6e8c7041e0be6aff2f0c31cd2024
SHA2566710ca10e03fab307d50c772d6d4a8155bd3f16babb2d46ff10f87510d222899
SHA5129ccffee2b69079eed54188b479d95cd5c1a8fa82555e86bce8481c2e5a4a90d486779421143da163177340098001372681583cd434d9180309977fd283ebe90c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b828f1d16a0b390df1e33e3bd136f70
SHA1490ec2dc82f659d34404c89423953c377f9dd658
SHA256dd7a89fc3039e17cb920b03dfc31781e62ce463f46ca1efb8aadc3a851c15dea
SHA512fbd8b5ac8b63fe57c06772de53dfa5b6dc405f9af4f1d1c27de6876ac4ebb54e682c9a9225238129654dac59b852fc4db54ff8a128191262e09c666d6f8f97da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542dbf9dabac29ec73bdd67635e29eb59
SHA1556fa640d81b0512fa5033845d1da0f26cc3c1f6
SHA2564796d433c18a0fe7222ef74fefb1bdcf67cffd7763404c83025851a0556f5749
SHA512f1ed8e6e68f061eea7be255a8550c159f682735086384908c040a7a2185063d9b70ac46a387c614be8c436dc28d25df66cd6a0cc8bef3eb5880ae55786c6130f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d585a319f40d135278485305e8cfaef
SHA105d682bb4612aba83176eed7a2819d47c99de44b
SHA2561fde086f4d1be7013490f6c03c9e9349d82d3a249be3a3e51bd6d7f3c4740530
SHA51214167278e360fc9221bdc0327382f96648da5469460fed48fa02fa7751bc9076eaf1c5e5212cf48adb287a2a8d2f4088b1c16b7ad0ac66da520219af09756082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f34c25a79e9996783a21067b3b5e602
SHA19093f4a9cc82dddbe1c006c68644e4f52cee6e64
SHA2564068c235fcb63baaa3fbc667739231c524339aff20960ae4992329cfe040a0b3
SHA512d33bd90613ba28a43a12bbfcf56507421f8556301ea64f408c45abe524be38fc6259a227fa017771ff7beed471f168a89fa02bb47eb125156b2ab8406ad59e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c301bc38449822dbf433bc171ba0e6d
SHA1a8afdc7fec3fe698d5e96099669cb1e3c600ab40
SHA25617a683f669adfa24e8e1b19d3066e4b3043d425e9cade232bfa221e64effddef
SHA512d999de8106c70d604d05141820f89c985526c46c5965089fe3ad3e2ed56d47b1fee4de208b797a5f5d4ca8a2eb0dc66ce59b41027c1d4cef4103e45d800f6386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5774515bcea5db71f3a4126ad3ec2a21a
SHA1e46eae116763a98d0245e4f38f6605b670e495e3
SHA2561352ec35b29c36e2428c9cfafb68088d90d7dddabff4b38cd27b97269f3848c0
SHA5123e6b4ee079eb480fe475cb1bff962fdc8dc1206fc4f1aefb1a121b8f6f53c149361b70beffb2bb506f3202bdf658c1db4aa698322b6ad9acfc1d495e3f2ac7a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f16e22dd62f93d0c42e4da853adac6f0
SHA1fd232801830dc6e6ecfe7a2abfadfdbf99827018
SHA2567eb7b43093989ed071dcf244346910cda0cfdc6dc319dc80d8819e3004472d7c
SHA51203efdd50af53f3e8af724fda433c91fc369ac587079a3617223d186b83976398baaf4718a94c074b1265a716e25f834afb63064a28cca208245b2c087c819b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55717fc7335e072a9590704ccd70d4790
SHA1c3f6852fca71ea7285ca5c536dcbfd013b3ef742
SHA2562cab57a5398fad2d14181103d5db275816e2c0d5bef6db86bc198e817154a26f
SHA512cdfb2cd72e4ddb4e57dee2f3c9c83db33c797fcbf2f83d2a7c944a669fa43fd07a479f72a0d8cfe7a7d27c182eb24c9e3f31fa9b67ae0891f20e80c6f8def249
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528918c88f73ea8c90942436f7f244e4c
SHA1e86296f2469a6dd45e9970b93354ee28adb4074f
SHA25650b64aec24e8be9fed69984802697555964c1e9b81a2af9abd9d053142ee5e44
SHA512feb9aadd537672082013e72b672bfff8d72990a21b52cc1f54f154e3c0e9eae5d677932a09f4c13c1b28aeef315c91f2f6642326c064b51fa978b22b18a5826d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a44037e7bbabef207b296a757dd87b7
SHA1ed5443831c71c9a91df221f740a0f1b7e330a11d
SHA256bcb09ac287fd9d99d8f8942dc11ac2503fc8cff07e6d8a5c39949bbf96c108b8
SHA5123d55f568f75f62879908b5fcf2c8cdd4944fa2bbc86237c291e8a18ae826beab8202d77ef95ba3e9225b2556a97944872bc12644f26c4aa9cfdfa1419ca13b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cc22e6a2831ba6ac3980bfb345e5779
SHA10305159fda5788ae91306d9255cfb51ec39cd8fb
SHA256d26578e4b1d84b936da886a15e8e0fa974d125b0187f7f4f587d34225d86653f
SHA51207f941030b0f5ecd3af03fc4c059c2355bbc73347ebd3a02578d00fa2630b7b3f2d550f81fee2a3a78dc64c9c83376e894daba90e9d49c1ed38e2d7921750d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab503d383aaabc60bb2cbc4b3458e719
SHA1dfb5a1ff9eaa07ab7a382dc68dce4d5401dfb159
SHA2561a83c6feea7f49304bd8583adde232ba9dbcd4cc6701733cc4c2d2d1508f817c
SHA5124f455b9eef46e0d74fc62b837b93fdb64ccf636009a7e8f34b6acba0febc665b28ca65c695abb605ff135ee4912df7e24d400972dd13ebbfd5306b98fbd8c483
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b