Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
97096f80464441890c968921a6d1f684_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
97096f80464441890c968921a6d1f684_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
97096f80464441890c968921a6d1f684_JaffaCakes118.html
-
Size
2KB
-
MD5
97096f80464441890c968921a6d1f684
-
SHA1
28dc97c85da2becbee417859f978bf2ba1446371
-
SHA256
9861f562cc39c97a1b24054c60e08b8df723bf739c0679341d7daa5ae746e578
-
SHA512
84bf2b9350eab88d0e3aced4ef0ea125eaa2d42d5b29851c46e9f8c5bb2bdac30a95176d0b1527169e53aa5fae8fdf4cfc106aa3c35f6c667bb259e330fb0856
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423717768" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008271efb107d7e541bbcfd0080a72fcae00000000020000000000106600000001000020000000cd8aace2ccdf673e37eae1cd322a1231c4ae7e21e93372aa18b748928d2539bb000000000e8000000002000020000000deb99b1326299e562d0ed90f6753dfe2dbcaed7dc6cf1dc6c45d35d9ff77505f90000000baf69bafa7f9c0dab148fc294fb8ab539d2559f305f38e7d70271caa6915d2282d2edcc4d942282bf594370f16ab8e7bde78636a6ae5608f79d82153c24f6ed35fe2653d1d06aa5420d628f18a600d55a984b937fb615a43e87dd1ed2e9ca382980e32929c603098daba5cab6c88d7240fbfd4a51532e363c2ec7a8c6cdcff88c136e8835b175ddb0ad1187dde65ef5140000000ee00f97cf45d6732e4fb577d9173049f49a24817d7e1e72058396b4d2c7842e1a74da35f796a6c80fc886c490cbc8431181f56e74f18714d78f70bef736048e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87FD7561-22E6-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008271efb107d7e541bbcfd0080a72fcae00000000020000000000106600000001000020000000b9af902554e818dfc943198dc204b3ef5a2d1373490427e5110141d07fc7b56d000000000e800000000200002000000003d4bcaabebd7f5903668ce58f9c2958f3f61ca3ec6076ac3391f634e09e7f602000000045792aa1805e2f22a38acf28ef6400a88a18f51196a1dadc44bd326f08b743664000000010d7dfc18192428f3bea065449719f98eea98aa075be9c43b11c58e0c8e4669293a0d26f4ab655ec85e1fc04011fae49ce829b0d50efe1cf442cb6837fbb8ed2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bbde5cf3b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2828 1368 iexplore.exe 28 PID 1368 wrote to memory of 2828 1368 iexplore.exe 28 PID 1368 wrote to memory of 2828 1368 iexplore.exe 28 PID 1368 wrote to memory of 2828 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97096f80464441890c968921a6d1f684_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ac66e87aa0145bc5230e2a28823d1e2b
SHA17ccc980d4007ee0cbe5b12c2e4881aa66d33179f
SHA2569462bdb493e87ff839f374ade2aa7b630de0a834d9c3c6e5db684cb364fb1a87
SHA5123b65817769e57c18f00c9b414277cf7a8be7bfb344e45af3f6b65aa7199b4f7850d64cf1aa232b1e79541de703aaa454e4dd61f4d6c2f53acf95bc5306b158f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d3c85e5b9471e75f22229cc080cc7e7d
SHA1e1e6fe752a706e3adc1c6b5002862263fad0d417
SHA25678f1f7091ff8f0fdd27612e35a4fd3052c0a6345f9ab0789e299d4357ffd79c1
SHA512ae7963d782d458ed572b01d5a7f567d65aa714db9317a46f6d9643b190be97d305506acaed50e7c1c7c3a85f67b544a236020e9c4126e5e006717b415ea87d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5161a1cc56832cd0c4bce9849d9f5123a
SHA17ca0171c1cfa021adb62b6fd2a2d11cc10d0cf29
SHA256d9113ee5b8b12ce07ed8824fc06b4c9617a2a8a2f24b6717e154d22882fc4841
SHA512eda4ea8a8a8f42d6836f070ee32fb74b411d6e7344560d18552c04b7c66c266b1a47455f97dbfda7663e58b569dcd1d58392786a1e914fa33f8c57c15e8766e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57041b6d4ae0dc800b06bb6d8a41569b2
SHA1512d483d468c969f787e261e27333ded1e88a657
SHA2567c80c7e9e5315edf2d067239ef1642eb2cfc0b8c982021d75b2598ad446abdff
SHA512fbbfa039e97d34a5b548234a6434de4a31a500e31c02af1c2a6195207209e5dae49f90391bb76b6b3069359c6a647560b913e55447fec011f2e184a5886dd06f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59012b4491d16be03c81baad26a2d88cf
SHA1794f06874e65c6b11308b5e77ba6bf4d3c5a2b78
SHA2568b48fa9faf8c92e9a7a168fe7ca4e0a5a4acf725fa4750d82b84cd78a2405862
SHA512cba34883b7c9ab5e182002e92690163071b6b5afe8f4542cb1c6350815ee4d1e956d3c21f95944f8c553b98398cacb263c9aba5d0e892409cb27478d675737c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ba65357dae8e6620544241c09486b6b4
SHA1cea9a89c8f4183d02ea2dd549d0314560cb85be9
SHA2565d89b9ee42297285b49c22994349b11e8540264ce0a353601ac1162f3c9c6327
SHA5129b920980bb84e50742d05f4edd9055f609ed5f515f281101542ae2e1236f2828727cbf78c1649b3a2a2a07c25ac9372163e736a61d941c4c4c9ca1c3e9e45869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD555db0ea1d5f1a6957126bf9b80f96665
SHA1b806f035d7c1c3e939a116c5e25b77254efae154
SHA256d1f2461fed410a9eb9481233ed601a28fe8c1adf08e163c7bbe3c0eef8e058fd
SHA512d185cc1f6d3e18717ee924d20056acae0c5e5d93f959a646af44a68dffb456dc772c2e0be3385299aad2df907b067655b2e588846309051a3e2001b7980bd866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ffa668920ce1cddcec0ecd32af37facc
SHA142a9b2a7a215b94ab5207f200f3c6677ba1157f3
SHA256cd59cc403927df372445b78a638e94ea106dde274a89ccee7b0710b432dc2855
SHA5125bb3d15538e898d4d25061e95079eb25a8de7b68f349b247d787a81d77b3dfd814ee8c67fdbf87c9e2cdf7dcca63c6bd2686094fe8a845641bbb527548226bab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b7c3d014a6ec7d5bab6e8b565c74df8d
SHA1d434ab4dc74eb4fd841772dd5bafe4395a429bee
SHA2561399a5a6f3bee4c0b107fa5ae269d197069caf09d6313ef3d50f01319d08cdd7
SHA512afabd49fae1122d22300d730ea34d878e2b0446db1bd08e8a602a018cce10e9439146ad73578e779900399de9a72271efd41dc46c631e131dd2895eb3ac2c34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ef7a137d2cd24eabd11e8d52e9615208
SHA19ca78a4e32a4d7470f9a1aac3512953982ed066e
SHA25625966358baf16694b68e9f911568748bd799c724bbc87b7f0e1943a162f03f7a
SHA51281cc558479c6bb9cdf6786c93984aa03cf61a52e2b1e2ab762c1fdd4a1f98ba5d28889681349482074dfabda504172e587a85ffbaba7dee314efc32659387c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51ed15589bca609e93b9e561dc0f41eb5
SHA10f292f91c62b55bf054859a608122da6c8f5dfc7
SHA2565822a87eb1fd21dbd73afcdd30617d3eb16ff31c5867a479e3388c1cf7b3e407
SHA512a3a0f019a20936c814c8944de248a405aafb5349b65c76ed22feabe15f1fce671dbc23ef9650abe94d7b67ff97edd5cdef613024c358cdb14dd04e23d264c80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57dd033c0b8c50c952e9348539497c21b
SHA1038f3e0ccc40b5f0280a2e9fc48fe4ee1f996152
SHA25641614b996d9eb642fcc2ef031ca72cdfeb0ebd4d8dc3302aaff854b65f6063c5
SHA512395fc142556edc2e93aaac4344b7128e72a5618854679a8ea60959372ed8d1af63a2dfe7ab81428b2aeb3df977ce780076f98f70c13fc75131a37fa74cf284ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dfcfdc020af7613a0d82a1c48cd45ff9
SHA11836283dc9bd9a9efc1b67c7d2905170fcb30927
SHA25650e8044624a4179d29379a08fa5083e70101fd2e4ca3a987c35bcaed8483d03c
SHA512282ef769615e8865490b0bbe53c68812fe7c0d25f85155324a8bcc6620f3f65cc9f023db23c32bffb6265aa1c1b0562c8adbb5cdcbbf957e80e9df2a020bdaf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d4a560ff93555b153794f9bfbc40ca6f
SHA1adf40d44fc4dae97351a094529bfa3e7d4718c3e
SHA2560839ef53229fe153de86f9c9d02ea40b2c1205d8f6da3b287404a73c03724f6f
SHA512036a7fc9c9c99f97b8e310521ebdea37d35c3cba620434b91f1886b0a1a86a6df8d536cacbc7b42f089aebbd21152427a7ba1ee4f4cb24037017f7cad4187f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e71d080678af0a97545cc79fec383d76
SHA1dc4824f3d443be5deaebb1b314fcc687e6a75208
SHA256e9c62b061cbbbc3011661cc9c41d68eda270282bb681f846cde47ce82e9777bf
SHA512e952584de3e5ff87314628194b268b976c421114bd5972a2cc4630d20be8bd5d4318251888ffac57660b5b91b62162bdd443910c393ab5b125f466117e870801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD558b7fb7903d955976666f3a96e50fc69
SHA141a0a0fe9d257b5bc8e7576945eb8f7a2d245811
SHA25611369fddd2d95edf53ed8cb352d7544a9467b054e0c826669f46f9ee330dddf8
SHA512e1c479f7856ecf957bd5c05e469b0f5a5fe0c201e2b54ebf869a16d0d474c0a68e8cfca5f42eecdf0bf84f387963b4ddfeed4bc45be12fc53dc8422fdaf335e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ae0de81e47c9115f482c7f09a683944a
SHA1fe883278cba36f135185650715e464c662605cef
SHA2566992ea4fd1c4362e07693942353aacfebc14dff51ad5475aec56544c01f5ff96
SHA512e35a6d644091231b2a5ee0bd097bad07f5115c9fc4597ca0a7a39af72fedd8d60c96ce62e06fc78ed7df996ff71d27b3b782a76e9ce744c6e924a2ed555db1ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b