Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
9604916c18b08cd09e4290641e7354be_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9604916c18b08cd09e4290641e7354be_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9604916c18b08cd09e4290641e7354be_JaffaCakes118.html
-
Size
20KB
-
MD5
9604916c18b08cd09e4290641e7354be
-
SHA1
2874b95186f20a73dce6ad0969de1bb8aa5f40cd
-
SHA256
a99cf6e079ce9a2e34485f07b31b74d4a57f7259999417dac0b193691865df88
-
SHA512
4b3550b7cc5a2a58262c84bafa15a6c177ed63cc5f43ab85db2f0b731656191de4b5db50c1a578e62e02aa741ec184661dd1873f51cf977cf31e60124800e09a
-
SSDEEP
384:Y6QFwS3JuTLVSfdx+E1YfqjpSa2AxFZLGQL9Mv:Y61S5uTLkCE1YfqjpS4xFZLGQL94
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008aa4b0f8cb31c748a9e2bf331fd005ea000000000200000000001066000000010000200000002dd68b3bd53fce80550e8377e9191181077c257012376b0710514caeefc28544000000000e80000000020000200000005b0dbbf0410eed992a0c26955b25d2db6f8276c80127eceb3699f9b7aa72e6ba200000000efb138b2f7c8d04f9cae9fd8f7aaa7ffa7a611c5765e3ab7c1d0d08f3c252334000000049e89d7a0d9705ed2362b69c9f819f1ba00f3bf9f05689e7469a07a4e6239f8ec249ba264602e70c18423bfeb5207d030a494ea6f0fd42299d96655aa809470f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423691603" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008aa4b0f8cb31c748a9e2bf331fd005ea0000000002000000000010660000000100002000000011f1e82cdfded5fee837f609ea28fb9bc1e56472e8f14b3c782157c070f7bc9f000000000e800000000200002000000075d8fda143585db7d8aa16b8f0200f816660aa8086f24437b6dd79b383c279f190000000dedae090382c992f0c2faf75e460649c5c1343f04f6a881e4ba0343c0b2520e0733e39a5668c661d33bb2d9bbc34a5fb23560645d0338080c99a24a64110da9a6e7a770afc73746800718ada2bd758cbb27293fb02d0a637328966670ff7a317838c93600ea1e1490442fa96b12b44380e169d04b2890f081e87ddcd785814b5dcdd6edceb2e3650e83b0e39efede1584000000044293d4a631f3d5da1429cb4cf3c00c52cc6ca82fa431094d467bf5c603728a624ea5b37d7aa43c3a2010bb8a063d12eaf3ef13a26627b2ae337e0749b51a700 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30640572b6b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D2CEFC1-22A9-11EF-8414-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2208 3000 iexplore.exe 28 PID 3000 wrote to memory of 2208 3000 iexplore.exe 28 PID 3000 wrote to memory of 2208 3000 iexplore.exe 28 PID 3000 wrote to memory of 2208 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9604916c18b08cd09e4290641e7354be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e5d930cc06775e7996d267d9cc81063
SHA10da6c290b4eff9d9cb369f08db286fea90a060be
SHA256772e62b5b813dad5502483257a064a29caed1a5d3442b3e78a7d0a551bb50ea3
SHA51285d536be4f1f134d2a77d12a6e7889a90a28260e7e99c003d8d33c8fa8996b0edec2041839bd99754588bfcadfbde4ec531c57869fc16ece17723c5f21d9c59a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d6152d91377c1443a23245d997a3f1
SHA10580784068ae8ba14e754a49fe6f2f1a2300add5
SHA256add89a321d4dfe3636d1047d19a88b3ce28b94ffc3d6e21af22165f095f6fbb2
SHA51206c0c26131669faa2c0f76c483c0d71281757d9e58aa56839b1fa55f943540fc324fc5b3486667688b07b1c60563125f072d915496344c041a24b270be524616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58773265911c059e6888fd8133b4e7eb2
SHA16c27a331277f2704f72a4fedacff28ff21fa7ed0
SHA256aa1d180f2362b87591d18369adfaab015097a4b582b0eaf8dd8055771f16e641
SHA512a9a7681660e5f8380994276f8464656eba9f13968f5012a5f162c4430a6cb7ca4020bd1e719b1360fd3cb277745b68194e35523a6f118db6e0e3d81c79f115c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f95024b230e302232807077b57ae2ca4
SHA17982d2c4366ad91a6e67c1793a9121dc4518441f
SHA25606ce70e6a5320949611ff11ee2549da94cb12d10a3d7de5f8c9c57d3bbe1fa11
SHA5127afe0ff6c8781f554ef3e0dc5889b2e0013da4338fe0ebc8557e7a3f9d963ed3569df199c1c4ba27bce73d983a2a3a558bebae3c001117bbbfdaf6a4270d1427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea42f513d14ced2495cfc58ccc366a55
SHA164a1fc03ea3c090e180adfac33e6e4f0221e443a
SHA256308867558351dc648b86b6ff40135532a599af81f20301238a8db5483ceb3cf1
SHA512c1d96df9c155ee0b54c736c56afb3a43b7d3e3fab10b7254d9c8e5ad1e5f09c228509b16f9f5c15c5a216d66a992f44d96fba43a8a643f1c25f1ec69ead15dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538763a2176604bc09bee5c777fafcc2b
SHA1a36283eb27aafda5daabd13b7a07b48ec81ffd6a
SHA256c8777b500488613ed1e46fea078ce9c5f418378da8cd7ee37d3b75d6ac6d497a
SHA512571c4678eac02e7cc8b9bd2f3287c6274248156013d7bb17e57f4583753a49ae71d6be60dad7ce676d025175f1a0f6e8dbbc2aefd3ee62592330326d0d807cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6907e4c155a78b5a72fdbd27afba995
SHA1998bbd23d054212fc53222787277595bcf138850
SHA256f9538c26970dcc687e827448522485cdf4ffc0272d277460e908ca5db013526c
SHA5122cf8a6424b9b7eedc47a2850c8ae6429b1d70735f3162996871f70d3f49dfcb97181b543b2b4c14d2644a8a9cd82b4943bb4da74a815195dd7238e66089bf678
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587a31c7ef51c12881ae91b04908943c7
SHA1c444f12514930d6923f7580db197a7b533689ac6
SHA256c92ecc709ec0b875e4e9ae4b541bd3d573c554e24560fbda51a4f09a982682a6
SHA512ba63d8f8e4cae5c5fc90aafcbcad5c7466ec9938d1c857e6b52118bb56c2e075907c3de123af82df95096ff55ac4e3c3ee0e81304058458eb9f9c57c5df9bfc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d17bbe6b21dabd447f53f9a26f25c1b3
SHA1fdb5afbe01c58fb2375352532a00f2a65599e1fd
SHA2563cfafec7007e86735f0e88ae5548b36b8e02a5a53f656bc232120274c4378fd9
SHA51258a9230dba90723c5115ea3999b20996d6fa96874fe154c0e97919a46325099aab79b0b15add0bfa0699a22d40738bc79fa1a464aa1db48caac17afce13bd8c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a272597a55777954b63ea4e35bfdd32
SHA1b792ac19cc3584e3ec0c319751f4d4030be28fbf
SHA256cf2b37ed0d3608ba0e8df9df72729bb7b133d008d42b17a94adb2da68a94366b
SHA512052407666390a4278f7cb624a8909eecff8617be0416a470c9e40efc1eb025db865573d3793e0daabd27655a5abbf0f347b740ed8404d488c918bd9cd5e9f980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c79e27c1855ba4feecb6baa21171321
SHA15c0b7d579d2695774b5e7e52f84e56f808ab9cd2
SHA25697b52e5d3f35ed2586eebe50ec38ed69cc4486f0a9ecd1d51ff1f1885ce89ddc
SHA51284bb3ae2c01884b2d2498352ff04e15c9688b0ab58c067ca85ee551cffabf0b76f2e52fc34b33161508fb2bc7bdb4db859ff84531540653a247ce1264cdedfa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5339c0dbbcae2bb3c2c9a43a9be5f9ee4
SHA1f909fc4d87896fe9cebba3ea48673a4dcf3c214c
SHA256caa98389f1d6a77a5bb0727cb5f3d24bda47ad47b2073492a7e8872eacf9302d
SHA512ce2fb8b5be71dd19ee870f3ded8f3f04e5e759609e4458d6751a6572a6cf326a2bbe7984242ad787eae3d135304c9bd413ec4376989d6445a9acdde01d76453e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520a5873de74dd4a8b5059c5047c50c27
SHA13c7bb9ce053b8be9f9dc69342ee925ba0386ede0
SHA25694cee02c0601332f73ed36ec857559aa2f2abe0dc76b29afa312dec50fd21430
SHA51225668acca164983bfba1a7efea9dfc7cf019f479c1b159b1bf2355ae9e07892b1360dd5fb09d443d9d6edb3b7ec892f93464a653ccd69a55cb0b4d46be9c3dcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c6f475dc3d53e1d82db9102e09e6c79
SHA1ff95799fd45b99c966e90f4d2aa8c483d9916cfc
SHA25638667ac738bfb27b91474f2212e34de226c5bc7f524d1d5b49dd66ee7c16ad52
SHA5127ff491ff37cf7ea6af284e64ea38b861c4ed90f822e102799318575625d8437d5abf25b5fcd25c7ed7aaf0016ab70fc2a9b81e811376665d213c3a218f1adf93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b404f60ffc61e44efc90c37b6d911b5b
SHA169cdb2bd27a495815fdba0c1a0b10981f7c7df4e
SHA25699736982e84ff9c3f2e3fe45225d2a5a05771fc73949ad7b587add801a4d4019
SHA5127a1ed5f9bef21955f326fb84f9ce56f855025931694d29ab86d15689b1dce4c8b7c61d13b17a9fed96ffd004d53aa89dec1f35d25987d088b9867244fd382998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebfd0484d7ee8b3fada9e7c5effde70b
SHA19d3bb40fdc9c10fbca93477983f35235cdba9bc4
SHA2563619e947d932637bd8720045a7b05f1a907ca64ae732bd49db9f9dbaa1d30e97
SHA512cc203a6ffb161c7d72376f946dc947ce84f3acbb53425ca5c4983efe226a6c53872a65b9f3a86880ab98321095db63be44d404ce36d00f90533010c6a87d66fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4474203cad6645b1edc0f8aad21342c
SHA17c031ab62d6276a97b16bf4b89fc78801ef51690
SHA256834994497bd519f3c3b3fb7f1432979b9306668f96f1821a6d40e46c79d1a005
SHA512482dccccc732d0f81fcca7d3e4d90026f83e3b60ed55bb021e421b42f32e727baa5d15c2004be8fd0f03291224095368bcea9f5aa72c42e54f99fb4c9d2358cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55da3baff34334ae2dd2b921942fb1627
SHA1a2ecf9db9a2927d7be037e99342ba8bd5feabec7
SHA256d027b3dc7ab0f09a04e92cd5a039053f003be28b4d47bf04970f2e591877d54b
SHA5123e7d46321724a8aa63536ef11d032ee9c79a8683651bb86612f85e7e64e0066928cc8eb282bc4957bc2045fcd60c30faeacf0234e92f43f77ad3f7936aa6e141
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b