Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
952ffc0df89a9450956f7bee8a673349_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
952ffc0df89a9450956f7bee8a673349_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
952ffc0df89a9450956f7bee8a673349_JaffaCakes118.html
-
Size
460KB
-
MD5
952ffc0df89a9450956f7bee8a673349
-
SHA1
7994b8834de8d4b47a1b4e86829bac9ce87aa310
-
SHA256
38f8553b5cca6e12738f7a73923ff00123709089d835a584b54a31e813d459a7
-
SHA512
cd7ec42ffc71292b38473702f9492bcc1ec7ff0bdafb765f0a17fc7cd6202bef0910af191b094b4da7b35c6cabbdfae2d17a37b1631b38e4c8ba46e85da4932b
-
SSDEEP
6144:S0sMYod+X3oI+YvxsMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:15d+X3h95d+X3h5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008d33aaef83e6c44867217c788e25dfe000000000200000000001066000000010000200000004ab7e0e938a0d6c2c7eb24b1aabf344764ca8a186bd004d9565182c9b7f29a22000000000e80000000020000200000003efda20d7b3dd8591df2a0a9b96ab98d27d414a21a4ecd923edf1f5fde49c84f20000000d8173b970c6173a81db9d9738e2b5833d0ba1c27a4ab651eb074e0f464b2f6b640000000a2236df928b261ec74ae5bb99b06d6a235cea4f4407a704accbb61058548d09e4700896eba543e6f09a0c6fd04425f2706bcfe9a1735e4b80aa3445fbe2c3595 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d04abc8bb6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3C32F11-227E-11EF-9D76-F65846C0010F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008d33aaef83e6c44867217c788e25dfe000000000200000000001066000000010000200000006e0657e1965e578cad456428a9e41f847415754a643da4cef802aab98646c732000000000e8000000002000020000000af6579f1c3a61f176870677c13c79cccdce56ebe0ae5bc785f2fd4d45f68666b90000000a824cd5aec6a803ee88ccd946a448764ece3cadd29eea02bc72a46bf1dae69b1861d270ec18982b9dac3785d06d43a29df56378177abcdc3bd571b66d506ac21f2e3a038c9a0db368ab66f4ebe6c714ccb9fd02cfe6ba6ca4a99e3b291f93ff36e41753f40a8bc32351239721bc9dd3930e3a9af76f12264f5e1c3983a95d0654cfaedd9221546f1ff1f045950d0d8b64000000058918f987516395be0f8912469f5b2a55b5a130f641ce34bb8164b51d54b5d6d4334c90d490201f2388919951e2ac921940d00d2fb7dca52a60c1746b77ed90b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423673253" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3060 2348 iexplore.exe 29 PID 2348 wrote to memory of 3060 2348 iexplore.exe 29 PID 2348 wrote to memory of 3060 2348 iexplore.exe 29 PID 2348 wrote to memory of 3060 2348 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\952ffc0df89a9450956f7bee8a673349_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b25836de7ebd6fa315df63e49c54c423
SHA1c77e1de7b8702f1f1845899eca2322c8c8002b21
SHA2564fc93d20939ad78d292a508b534f6d65fe8d5f335f5d5457d8065f272c695fac
SHA512d3314698fd32edc87c56b780286873ae2193f782a9b20e183d79e19ea36b22afd68559063b5172837562b57995ac8d2dc7b9f7035d402d2bcf5ace8da5ffec34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57035b2a9a3599aa9fb6415ff87b81041
SHA1c123c8b048be2a760e38c1c88bed5b2c54bdbd7e
SHA256edd46e97f99d8f6dabf211d9598d5131b484e85944510efab98c7ff799609487
SHA512d3a3372daf480d1381e3512f3dddca2ee18494e611817523ec76eb18d994b5ac1e0b112270b0bb59e474afd0a74e8b558d152fad14e3324124d25ef2d5f38d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5690fcb9b2e0fe66fd23e59ae0d760e48
SHA1a21b0c6521a73b01bf0fd7e5bf3442cc5c414ffd
SHA256ed38069f572b6e1d381647cf202e7594fb94c25f6e2a19d6aabf1df18eaddf47
SHA512aaeac95715bb97e25612bf3494dec4a954f6eedf99a01d0468ccee95792dd73a327d7c4eee675d5f8bbaa47eecdef2787f55665391617ee3201c1cf1b6c91045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bc558dd5c3ddf2d0297f83c7d3b18b8
SHA1e7c23479bc86b3516fef4c0a9563ba8b8253110c
SHA25629310e0aa97de2cb2632f4db4976f9d91f497cf8adc4340de8984adb89d196fc
SHA5120ecd5ab25cd00891a302d8bf4950169765a2c96319af5ae0dd88f1f4b25953c70d9849449625ab0dd19eabca1f2dee8d43928ae5263d8d4d78b282de78381efa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc360687bd20ae4fd95d8546fd83b692
SHA1bb2d67174224dc21e5be2f393cb65b46f5ff1007
SHA2562c83c5202aa58af27f155e4dc7be7d21826df6c78acb9d0096c58a213318b4e0
SHA5126c6c702a49358ec1c95ffac65d2fdd3e459e5a1ae12b9e81bfa4c3bbea0ab1208691150e6841399edd02fbaf61f5db4816a0a2d892604792c43a549e41dc349f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beee198d6f751d10fc64d3115575959a
SHA1fc4a69284beb58173034dcdf1afa44fd76a947ca
SHA256361739a6419964958eb10150e60cf971037c44cc32bf7171c5a289e51217a8ad
SHA5123a28ff03cf3ddadb6567a63228a702dea6697dec09fa35fb667ff64ae98e8a7027ff105ab32e16ad8b5e7c211e339de5c89c1f34991a9161c8e11af9a82924f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0ac2b6b71b010f27ad8003863dab457
SHA15f58a6f87bad8575d3e99de5f097f97d016f4ada
SHA2561050a138fe142e9a768643dd77fdb7503b7de5c93a2c4878f53062b7bacf1e54
SHA51205411ad43deebb525d210d5cc031967813d474fe1c319d67f393efce59c940f75ba413319c50c0975d16d01f2746e3bd1df9d2a5481d8cc87cf60ecea56cfbbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5d54d6982f678b96c9739f9a774db46
SHA1252c21720a9b97937adc98ce07163e07ff630fc0
SHA256ce2bdcbb0c9880b3430a1345631192ca057b1a7d4529a8aacfb64efed5add3b3
SHA512053be62347583c8323cbdb36242509e67b35b59342d457100d66bd5f78ecff3de1a9c7afd0dbdd20bc33b3c78ddb69a597a1e29d5b2a1b800a542790679d5ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca98c829cc0206f54bec726aaa7a788f
SHA1dfa9daf61364e0a3185f0295d7e2914a2c6d4f20
SHA256f1ff5dd8ce9885853581286aa0dafc8586bf6139f5d75ebe3bed6d90afa35bcd
SHA5120957cd76247bb86b71c9ec827629be3b6a4783136f6fa8e1dbdbeec14b4b732cd24d4bb86c598f3e4b5f68bbd7fbc47844336aedd02fb739cf39cdcd4eeff175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f148510bfc9aa22441c2dc34b9c35039
SHA1b6f645be28fe17cbd4f5244e5d06921f561088ba
SHA256d539416f9ddc5acf108757bac8df8caba1a28853ebe6505a781cd46f847e6d62
SHA512276b110d3ca0f6d3c6ef123a89ee2d17ae85cc3e206441aca9911b85bf9e31f26b1e7eaddea36a7983f79746bf759a75d0205d3b6b3c12714c855bd12a7f3332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562de33024c641bfe66821b50d4743134
SHA165374506f53d531440e614192653bc60cf375e35
SHA2563aa749510c6c660c6a9efb8e050effde2b3512739820f6f4a3dd8492a7d934bb
SHA5120a75d65a1e68b58be3628e495f5b24cbbff51c458dea650d7cf965a10702e16cead08cf4876b6a7a39eb2817e5a293b58069d2b493ab9c217a72a552af01d60c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5639feed290991a58bf384431d6037923
SHA1f376a3aa6ea3644fe2d50b2b188f1bb7b265e86b
SHA2569925bc2d1158c1bfa7cbfa4a95399fbdb497b8f76f85e3df019884e141da191e
SHA51273b774d04a15d1d306481d4032e158fd5200255633ffc6c4f63bd152930567e0e905a86cf00baeaa990ab2acc24acc8fdb4f16675c47017dbef682e99fc57c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e13106667d05ef9dd7553ebced18959e
SHA1f0d84359c8a2971a6b81fa9c4499865b2127fc9c
SHA2566ce30b397f17bbffb2ec0a51f3c990905669aa29f2b7175dcc1fa330a0d518fc
SHA512dfd81aa49595f91f488ddbfb5342983fe1d6faf9c7d31f9bc69a7cd3ccbea15fa06d336f136c133e901d11d928c6ef9c4a5a16652645c8324995f8639a6badb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdb323f7a9c1576a3f1ddc4bf5e809da
SHA1bca6521f87bccd7c62a09f42c7d1369ca390ccb1
SHA2566d594d3497491f9cb414857e6955d19b050fe9f1f1d11e06a614440da2366cf0
SHA512e0b3e428597c4c9d6f47811a3e9abc7e040d670f8e74c3e11ecaf55b1f84e93a119c1522f24c38d86a42288f421dfe4e3697dbfb8540cf12695f714ec9e4d809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55705b7856c5b2d126b723472d84e0d26
SHA1bda49e2fd2fa29c7b3e14c8463ff654ef6f4c13b
SHA2564bb34aeb49ccb80f68e63407416fa01def866864c71509365f098c196220ea6d
SHA5122df02cf8e85d424969653318dc88613aa2df736b3496ec999e46ef482f88379846fa838af1bb111f37640be0e4c34c28750f8a58bf30b58959fe3e0369278a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1c95b3ee51d125843197400e23026b2
SHA10e972917b5df915f0182a5a02d17d0b384fd1c5a
SHA25616d88485274a9d616922dc65dcdec25d5ce81d65d42b214427b24cf271abe50a
SHA51258ed862dd08cde77254d81730a6acc61aedd652ea945de6023bbbdcbd9c09a784712b965262f5c1a1b93c049f4a4132006234332a037ca72d25b10c118143611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5616db9169962f0317d501d7c2593fa2a
SHA1718e3622d5b7e1b75506cae4933c8c8c829c842e
SHA25681f9a9ad3b9efe9002bb2c745c028f06efd4e21d6bda21aa2005efefdc6c5db6
SHA512261ca4608b4e52b08cc14fed4ee337ada701925775833e07a676e54ba94cca4bbe618de944a88ce04fe384a000410da8a616fa780bfa31d95dadb47f8b010502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b886975f3fe2a426cca0d3930de5f813
SHA173e4bdf716daa351d9a234218577fcef6423a9e8
SHA256cdf623b957e64e4d375d04a49add329450e148dff7611d7d2845ff7a7d9bf522
SHA5123e7e011d5b24ecfed8ecc9d69081ac0a04b95a9d5415c9f7a14a60e2f61f6de94831a0448763ad1eb1b097a3f21721263f1ab48a973f7e3a070fed4f0f9262ea
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b