Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
9611426a1873f1a0f415f174f803ed69_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9611426a1873f1a0f415f174f803ed69_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9611426a1873f1a0f415f174f803ed69_JaffaCakes118.html
-
Size
36KB
-
MD5
9611426a1873f1a0f415f174f803ed69
-
SHA1
e3cdf2254fba685fb5430d6eee852cca65036236
-
SHA256
0238d41648a3ef8eb942b85744fb5f7ac922429955be8faba45c5d091fb0f534
-
SHA512
78afada435f1c5bfb0bf7dae0217ef1867ad7c332547bb8bf7e85160dbc7b8b6baf36db11d33bbc2781868d761653d676cac0759a665fccc64a75047c4cbeb12
-
SSDEEP
768:zwx/MDTHXv88hAR3ZPXKE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRy:Q/PbJxNVNufSM/P8rK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02c7b03b9b6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423692700" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000879247b1ea633641a8931aec91dda9c700000000020000000000106600000001000020000000e72315bed1cbd89c077ad0f9ac79c86b42df9f9c3e5e7a6b156c79324530653d000000000e80000000020000200000002ab1f59592faa342c87b70fba3cb585189d6dcacb14d84ea9effa505183be2c8200000005f6fa77db942b4cdd6d8e79593b7c86817252cd6fe6d6e5813e76ce39ab4d57540000000819aed5845bb8a26d479a97a41209f22fff6f2ffcfdd32c4207c390e2abf436ac6ece875fbbf2164c9a8a1c36c770cf8dfd5461fd9f1a164ab8bffeb2fd0f543 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29A4E371-22AC-11EF-A692-6A83D32C515E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000879247b1ea633641a8931aec91dda9c700000000020000000000106600000001000020000000c1ab1f54aa65ddc5a8e35d0b9069955758d74c8b24f4aab557953e1ae78f3245000000000e8000000002000020000000436209d4325a6e12fd475223c8d8dd344f178b79eb1e53fd3d1d5d25a005690c90000000454a41df6d91f9299f4b247e80094e90d6dede374ff0591ac9ba84290ad8e69070e98c03ea7d073731a97e717ac11757cb3a39ab602edb01fd53eda68812944981206c0a720b072ef160efefd617d1582ab4bcdab377fd3a75a9a642bb46174396f5d178d092d16a8c998e7c710aaeecb47f7c90d553bf3fe8ef6fca88e3332df1da08623fe0797099b00d4d11081a6f40000000576b23803442821c2f643c0f1b91e73e11de5d882d4e02841547885859f9ec84d01e48e394e698e4756c71d0dd7f6e30f99a33902daf16ec2807f31d96d34f6a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3036 iexplore.exe 3036 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2516 3036 iexplore.exe 28 PID 3036 wrote to memory of 2516 3036 iexplore.exe 28 PID 3036 wrote to memory of 2516 3036 iexplore.exe 28 PID 3036 wrote to memory of 2516 3036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9611426a1873f1a0f415f174f803ed69_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5493936daab236ff01eddcad61725cd7b
SHA177b9225f2e92feae8ab10eff979d7f2986a107a8
SHA2562a626183018a8d4b572c01fe5eb0bcb82d8b36b74694c7cb9ae47735b19ff92b
SHA512d73f9f2f7b223a1a368771c45ed6eb7c02fd5386f6c2594edc94f646094f8aca758c81b1656bf7a1ff72f8e171b8b50bb5a2183d08113705c6fa7a2ae710960f
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f4688631fb794f87770d0e70c7a2928b
SHA1a00aac70f1c7ced1ebcfbd0a873387e33e5ae66f
SHA256758eacfea2f4f1525c3e174a5b6772d0676cdd35f95e9d820b7166c855ff636a
SHA51272418a94c72ed0811bc8d4c1a98da0f9e2f0c78b34d1663333d6b3c23e5d49079611206b624e0d1bee85811de1440d6a32703bd38407f5f4e4d3861309a10b16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f42c0da2a21ecdea35bb03c3d92e38cf
SHA174c246ba3a75ad470c5c5b535d4dd3428b3c6f81
SHA256155bb970f838496c319e38bad57a367f1d863667426d0cc1a8d179629d1881ae
SHA5122f364d039805e55fdf94992edad2f85209305931d5342d2450314970efea7bd1d2e59009dca886f66a7c1b668b6197ffcccea8a7a97adc2804df32407e6c1aa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b17063cedd67e383f143ea0b9da800a
SHA197aaa27551d3319c60cd6a08f1897fbc60b90158
SHA256c04c8331d1aeae140cf4ef40012f140753387bbe0bf7b03aee4c4239b6b156ff
SHA512fe2bc91742899493ac330e598326cab9555173d9d74d788f6c88c03ff3630feec6872b7e8334487d98f629bea698e6f3a54f5ea7402efd1289dfaa5b5ce722a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58933e24ed452068ac7ea93132761bcd2
SHA192c9a3ebd9fca1b20fb123c521615337f7cafb17
SHA256f223e679282d4b765a53d5b434c7a8833a453b5705468049cbb30d200c29556c
SHA512a814c2f5092b4902b5df16dfa3a86a31dca451ba386929c08431f1f83c64f7b4dfd296fd011d9f5e07a43a5bb30d7e08bc4a60ca335410fca01a0bd87e6b5dd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590dde5f2a24203fc85cf07ce857f812a
SHA1d458458fdd39ca3d7d5801c4a68216000243ff5b
SHA256e77849f70ef3ea472412ff8474ffcffabef98a230a47be24450c80950f730f39
SHA512c6846c8ae4333d369a88d8015f1925324bfb4d9dda2983d5e6f6764fd5d1a25ec5682fbb6092a8a44011ae9e1f8c0969a1d1a29a81fc26e1d1ddad93c1e3a0c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580ea36afa5d7a803210519c9f82005dc
SHA119d8b2927f2fbea22dd82c786a83c213e9c5461b
SHA2560a161e55ecc6aa22fea5d47d873d2e6af75a02d7361886b572a4d037a25668e8
SHA5128c5471c0799e1a9d23e9394f0bbcc12cb36930efffb47c62736a308278adc7fb284c227ca52d54be44d8b74965ac546dd7a6efc4ed32ac50d6c9bf583f433248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57716254913e47e590f8240036f0f4b63
SHA17c382917cc21f883278cd153a90d21faf187cd7e
SHA256577725e4da9adcc32c7499cceeccdadbed44e630cb2b6f182a3ce3340d20b73d
SHA512613705d647a7514e7d7641c0ff318f1c16098d11a50d4c8caa8a2e9be915aa5e3090375b48eb64b1bc6b6cd454521a7c899ad94e22b98f4918a12e744ca28532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb57a5f3c79c13d1007ad5dd37c36635
SHA1c53e99ae5d024882550cb93fb5b0814a60f75707
SHA25676bb82af7c296cf3c18157da0757b4d70ec14f59419c54fe2e744f057c2bdcf7
SHA512a61212897cd39d4db3d26819c36bd69f6a722cbc5df2d48fba97675b2818c2e18288621197d48efcfa612e7a0c76b291a71285a6f828ff9cf43be44f75d727b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfbd4e45fc0e958eae0b5c9f7509d2cc
SHA18620a57d2e740ddd3240fefab84aa17755a41592
SHA25683c86ee138f58b380e932c064a941a41555b3aa64ac8f49449a2fb707f4a9da4
SHA512272354961f38959232235542ad0e2ea4df8e22074b8bf5458be5fee1b0be5a23d643344e2a8bff05d24ccd090024f62253f613abd824ffb0d14c0d8196905062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537d9fd3c2e5712c91273f66e9e29d1ff
SHA159c5d2416785ca9c7307eed099e978b553bf9a29
SHA256dd01b858aee774b8b0a98bd9181924cd8ed2c8442f8d0af5f63e70559c487042
SHA512710e974afa84a8cc7c6e78b8eb2119e37c5e5a928faf020e275e3d2e7b8717ac3c36bf3b352c35cc3e3185284af3ab5616c4b669b7ae66afeaeb3fc3ea437aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8549eb43e32ce2c3d789c5044b7f9d0
SHA17c11c463837bb708d3418c6550e234f717baa8a8
SHA256df9e11757f8737c941126486af1d5a941d4e284979d3b0cd732c2871d98c7480
SHA51260128d6ed9a0bee7f29ec7ac3afeabf4b2abf4e87063d56146ca00194b3cefcc8cd44ca2445b51b7c5084d3d238281a78fa6bf4ee8baeee0df0c988227a624a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a390de8487c1e8e9ad0db2e22e3d5b
SHA1da9f737bd5ceb5d2d3a993819675dce7ef20053f
SHA256a50e6d22bc122784a2974be6811f49033c54e70554142cba83e5e8bcabda9e87
SHA512441bdb117bbfbd3a75939e7a0ef379c9420615d079f8f900f5a6f894c4ab48ed0060b6bdf48bf8e2db3411018eb6aef8669238eed9ef442fefa1df577906b9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0d8b483d4e24f2fd9cfcea2de8f6517
SHA1e0c9042f5639e29e82b7f7b8337dff791cf4f004
SHA2562153ed43839df8a1d112dc85088b388331a7bbf6208a379b5c65f1e9d5be1447
SHA51291fd55ea8fad575e34f7c1db8db601feccdcec7daf61c4c73d47c4ada30586f11c3f96127e759508aaa1964acf675aff3d61b7f12dd9cedf209eba879e68526a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a5a24323de1b7d87782426fff729c4a4
SHA1aa9c89a8d7fa379f83110fa73e6c7105868a2d85
SHA256447b574da18d44ba3d55a1f06e399afe5d9d29c20adade47f875ac226ada15d8
SHA5128b571b41c96fd0adf422970165c2096cb4d08f6041f25929b4cde854f9ebf76c1f407d88fab3379f6b4898be65f4d2b590a31d0cb38b4bf4d32f72007389aada
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b