Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
948dc5a26effc6b6cb08d90b5aeedae9_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
948dc5a26effc6b6cb08d90b5aeedae9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
948dc5a26effc6b6cb08d90b5aeedae9_JaffaCakes118.html
-
Size
19KB
-
MD5
948dc5a26effc6b6cb08d90b5aeedae9
-
SHA1
ce7585a9310a3332feec6a72874225884e3d7a80
-
SHA256
ccd513f68239cdacb179cf877911b8769ed14efca9bd42135ce77d4bfa983efc
-
SHA512
42826d89f0167a1f0cce9dd661125fe28c7490d4b48d2d9e506838c76d112986b89c3438cec23c9c8b837cb03b97fef2167f401d0afe6f7081eaf0fa598268b5
-
SSDEEP
192:bIOmxNUayVYl0/eqTiXBJTOGtL8YWUEO8xgpQksLnPU5D:fmxNUayVYl0/eUGJTltL8YREO83LU5D
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a4fae66cb6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423660015" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000267e46ef229774da9e16a6470f5419500000000020000000000106600000001000020000000d26b07265b885634e44f7edd6e08d1e6a2af5b26aeab31cfe0c8d467b819fd78000000000e8000000002000020000000202a2bf43412534f23f34d0890fa8421cb8ad5dbc656808c11282e20956ae643900000001b6056b38ec6897aae0fa2207e29443c9c8d79b6c808a958c2ba9297c6a912c66a3b2878469413847a7c7a5ac0c33a087b8e5ed96a25af354a250a1448ef6c068cc5eb79624e112ba7f4a7090c2a3fb053115795b7b933f96bb384cb1f85c4bd6415c48b1583d945eac4238f7e48e4db902d81e81331fb4b6cf761cee9c426f2ee03b173ceb1278777c314bbe1cfa92940000000646a2f1c0de74a6ea24114247339e7faff29956d43ea0628545965c98c58c934e0315d6d9fd2c3c0320014695145e57df2ec7fc20f24691565402abd22baa564 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11D05F01-2260-11EF-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000267e46ef229774da9e16a6470f5419500000000020000000000106600000001000020000000b4edcc5029207ef7e41eaab7ef352e351ceaee1521e3ecdc1aa42e1867207096000000000e80000000020000200000001b745ba024a1226f5e2d1f487985c43a3642a9e6585cf5699ca59db65968746820000000f638f4f7a29a32aea50995585dee1a1ccf50509cdafbdcfe901150531c1287d44000000061817b55ed8363bca9740484f53654e89aca577db8edf185ea17162604d76f3f56076bdbb36fc689c690b5e7e8507b8900d44454c219f7f1c2c34626b595bb97 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2376 2416 iexplore.exe 28 PID 2416 wrote to memory of 2376 2416 iexplore.exe 28 PID 2416 wrote to memory of 2376 2416 iexplore.exe 28 PID 2416 wrote to memory of 2376 2416 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\948dc5a26effc6b6cb08d90b5aeedae9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccbb0cb163b5ac43ba1c6e7d47b2a4ef
SHA17105e467716841c5908a6a75aca1a3413c55970e
SHA2566aaab4fd996a5ca6d2b71d224320e3b935d44d65b19e22454d931d0a5bbdfb10
SHA512abc0bc95dfb64c9c2240fed899338c370404e6703b9838a544c609a7220548c5f3f6af98764468cc3b3a5698ea4d21e3f966c3d8fa8f13710870a51e9feb0cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c6201d8c9ad98cef361fa42a608052c
SHA1085669d293e25b58bbc8fa6733100dfd48421d32
SHA256ae0b2f3529a6da8391ddfa581d50fd99d5016d448944fcd28c2508bad5e2f2d8
SHA5125d01dfcc61f45e2fb979b77e11952faed319f7a8d3de86f1ef5774f79b5d930b7662e4b8d5ebeac6f089055f65aceed1ff224e12e438b711ed72af6541d07235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561bc76a56b10b453f412deb089ee88fb
SHA17f3bad019339554a16c0dbdd0e5a22d3995623b7
SHA2561d72827606258b8c5375422a3704c838f9bf67aebfe157e5af2feaa653535bfb
SHA512359976858fbad9f74913a7aefd9b8016136317de7a6abb61943ee9a24d70c3547836f4c0905b18a501a9ace8ffd06258431d74f00b8c390ec5c4a4077732148f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5529e750f0e628ce10bb507a48a747eb8
SHA1ff3bfa871242f29eeea1a5d4ef78e8052237d4ab
SHA256c840298e527805ca9dbedf856630b12715e0722baa889e04acdc58c0b8525200
SHA512a7e871dc3c282a620d5305e42667f28c0127b8eab3e9026ef0c8618fb639828c25463940198a6c2410a5e797e66438b8857a25bdb0f5de0c686f752b2cac60ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5c62b706494a03333ae0287cd49e260
SHA1d99d668ad9cb227d3f875e42219e0f7891404e3e
SHA2562799067fc81e979d58cfe3028a9b921cfd82e7900d60a5828f6b88c753601aa4
SHA512e9fb2a7c61b69a136260d75128d648b05ef6387b6874bd195da637d18922087b02140f157c457152e0ef241279f7bf39bc564e6e7758af30f38694cb967003f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544711fbb6499332846901fe7ee738a50
SHA137cef5f67f5ea483163ce0bf9503ba001c4caa78
SHA2560fba4f4afaf381b428f5b2bd48e20bea19dfd5389c8efcb8b3630e718427aeeb
SHA5122e56188edaf8ceca76f1370e79e08707fc3f961448d4021e323bcf235ffa0b0e4925816954863bac59c53eb0d1f315294afe3868d67a2be14dd8d70cdb7066eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52119851e4cc2696bb443b23b5054c988
SHA11b321ba6ee9cdccd43c4e399cbbc328dcd334e58
SHA25623ca9520d006b5ad00d07d86274ef658284a3b909468313041d07de993028ed4
SHA512b3aa5bd96eaa19d7d959ad68100f211f8ac889ee6283d2654a92eda5b2058da49bd0104cb0f6ebd7c02beaa3d1785a5f139a98b54bc5a503631584ceace6846f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5605e9c6058f48dd7dcb0dbc07cb90138
SHA1d0801fe9ac34cd528f54fdb44cac0e381f17cdd9
SHA256925bb610fe5582ef7da3fd83bcccd847fd5a9ce635b6945a7bcb3f64c7ecdfde
SHA5126178df45338e2e587fdb604931e4871205135732ea7621fbcb6c1d767fa5c17fa33cd4d5476519903e0dfeabdcaee7dc1f90813e27389aa9bdc22167dc0ab4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfc3e15b2e8d94dccb705849c3de1102
SHA1020a70137216641482867fd387f3016b497a74c0
SHA256b8ca72da513e9140db4ac6d405f56ecb406075c991408c8cc6810fb20d51277e
SHA512c42b7aca900c151f980c9a549107ac91989c65dc86bc97e33ff682602a1995ffeebd0b6860389dda7a4ea8d8981359958e958c9e8339a0de7fac389529166ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f0dab7d24b54c60c3946646fd8d949a
SHA10fc4bfbc5a0601a10cafbcb0b5dd47f7b7a29d50
SHA256fd1ad7f21f8819461b782069620789d8139d82ee0416b66b799529bcf98929b4
SHA512a857bdbc3f8e1c428bc9b10d71f92bde638ffffe036ed987bd3d521cc859df4d56740be9cf19aceb2e03d5600c7f66c9e0a60d422b6ba55888f5d49ac370bfe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bda1bb2d25f1a1d6446ab6b534e8e27
SHA1600b34b9fbc1c72c0654e341c6c7ed605cc4ca0e
SHA2560aad413d71396315aec1ae561b8d0318335df39717d328e927abb9233b3b5ba8
SHA512e2a33029c8c668a192b075563cb1531c786f96e435b8190f1d80aa368393e1f201a7481dd7857ade1f0858d62cf962f362bfa53a81b3493dde94c10902237e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56624ca8bd5e9b41e032cbbec270c5066
SHA1746c97a88532deec67d6670dce255d188c677927
SHA25602aeac74c8ca5284e9a091d028fa1b745d082b1912fdd542596caf7b9fa453a7
SHA51296ed37fa609c28fa52b7784971a48d2a4f53085b1839f8d0d12d27dca3eb67fd059c4b43bdb6d0a3d4e9bb7cefacf94f78f68095fa4f0ab0f8e786a17c8f46de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b6fac2ea3d2d08bea3822bd6e58a77a
SHA12c42507681599446e24539daa937389752ced14e
SHA2563c8a61b6d1e6eff054fb9de5b8080c9dbe5b3ed068d4053487a60339b1733747
SHA512e91a6ae665098f1aa6745ac66d29d885769eb2b232a2f712f051eeedfb226fc95ed7ccdfec92a576c7c51f04328c776ea6c28a3bf46734972211ff1a14fd279d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c168e1d0ee40888e573a0f40b906f867
SHA1acc1eefbe2ea3e76a43e281691ce84cbd1350bf3
SHA256550c771b8e9d25219a666124db93a56b8671a39c0a80cb0a513b46f84d2df459
SHA512ceb5819b9c2542a8657962a7be2cf465268f1f081470a16b71ea500c82ef6b8bdfeae1b6eaaab980d4220c30d0e798ae71750a0272dd32cfe9ec1a384b3b6245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d080c20d689438d0db0c1e7260be688d
SHA137f37702860215a73c357c19632922fb21f0c6bc
SHA256c9f0748aa3089ff70a28c3a896d0c4c9262988b3755a425e216f6f86b106f0b7
SHA5121ad9c52b582eda47c9485c99bc4137847f0696cef4995fb5d33ec7f3f4a9a06633d2138734db4515974ef2527b96a9f368f837eac55f90e8df469b25f2abbe84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b03245050449f58c37bc4c94e302108a
SHA1b7ab107ec5fa6b7624790ba538a802a0c509d2a6
SHA256751610d15d9ddfb087f3a7d3d614731d4f4d373f94cb25cfaec56477141c401a
SHA512fc39d1a4e0b8072bfa41de5549435810f5f24bc1afc0e1ba31da91c2d7aacb59fe3ad9d6566e0a708d486b9fadb757d8558f230c96442d853bcc68309ca762f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e781022400b54acdb1b169488c481ca1
SHA1fb728b84b20b49e81e1d3c8eadfb0cbaa2ba199f
SHA25692bc06f691ac115ff200a0a4da067a8108b31634ce370cd42b97e0f5da6ce2f8
SHA5121334fabfe505d063c00928b268180ac66fa60ed7816991ec34261ba5f2582fe9f818f77149ebbc0e0b2f4d90867c0c87956698f47755b856a3827fe20ab0ceff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f453f1626cc3c2bccc6ed926c066f57c
SHA128912732d2014bf5a3df15e1cebf0ca6c3e34b81
SHA256fc71e5ca1d8f0f9490c0e9b8f3eb482458b87aaebd5bd2291a9c82b042ee93b7
SHA5122385404f29bfcd2f55bb5480c80e7653a34a56891361d9f6bd1b9a7fdc011d5b2951b4aaa19155f3df4c2072a10142e29043626cb5c372b9a6c13b8bc6742adb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b