Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
99d2e3e131c2976df25bf70d916953f7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
99d2e3e131c2976df25bf70d916953f7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
99d2e3e131c2976df25bf70d916953f7_JaffaCakes118.html
-
Size
186KB
-
MD5
99d2e3e131c2976df25bf70d916953f7
-
SHA1
4c18d5d7b2cf2664c47d04653dfa9691ecae0bce
-
SHA256
17942e8df4ba763ce8c7400632ac3e08087eb5cd8a179f4b2f1ff58996cc87c6
-
SHA512
d6a7e1119d377284bc4612165864428a91ba5fb580a0534ef4306fa25dee5939a53239dd9c3ab591972f802c936b423222877b00b87052f45f9c7053fcb34f2b
-
SSDEEP
3072:KyQJyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:LsMYod+X3oI+YS1tA8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000066d7e7da4281499ed024cc556317bd00000000020000000000106600000001000020000000b3546eb8e783f2d57aa0b4fd3bb1dd6170541cf2ff57c42aaabc328b5511151b000000000e80000000020000200000004789f3add6658f7f9569df555e2b2f4ef2a5a782d9a8b503a07a5433a146a5849000000006af0bc553d62b8f39f148ad059fd3d676cd9a5143d929d557b786ba6eb3a14b6aadb5c8ba137dfa255d44104e26112f23393580fee0f9fe330513b15ce1901af81c8b62773bc2c0b6df60ee5b2b6cf4ee8898522b9cb5d7682eceb666a96856027bab92bbd56e58dadf5d8011a0196b001b1bf031dc1c1a763027dcf00e3a27ab70eaa2d0bb908878c1f96fbbd85b6840000000aaf2e7149799fb555d6205f50b543c77cc4c90cfb9b3716af4d031007e8cdf265d883aea640d1f1c4774b8980a981a285409009c6c9d683f8c46307e95c99d2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FFB7D11-23AE-11EF-9C59-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423803572" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000066d7e7da4281499ed024cc556317bd00000000020000000000106600000001000020000000dcc3b3c7703db3c7648e97839a5cf2059ccc410b9112f1d3332a611a384f3a5d000000000e80000000020000200000000ab54f9979b24792994ebc791b98ffce00c005bb95546bf584fc3e66952e6c0c20000000acc58fb33d5ac8fd1a51b461eaaaafec9b874539f6833dfb32b1a6198899315c400000005bc54efda048bc91eb476e2fbf6a80548b6b3ea39d1d7bbfcc1be9e26cf005bdf044e33f61458540664d0c143665a42ad59407705f97305ad32c4628d4cdf190 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60291125bbb7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1084 iexplore.exe 1084 iexplore.exe 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99d2e3e131c2976df25bf70d916953f7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d2c7b6593df7a507adbe1e69228ae1f
SHA1a92648492d729601e4ae5b3ae6ef6dba3bccd4bd
SHA25608220f6fbaf9d04fab4456d096acd89fd604c6c54882a0b21efc96a392e9af7a
SHA5125e282fc07c999b3d6978c82ae037b30b88c8cbc2b1146996d89c53f430ad3ca9821ce46179841c639a1cccf49ec9ca0019d08e9d3ed8b9bf4d89a1ce55ba6b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d7791cc2741a5d8baa44e11ede25cdc
SHA1c8b42296e9c6aa17d94ecaa8cdfa755d9a48baa8
SHA2565f703118b249ab772674ce553db7a1d3fd3226b7b9aa25143f58d23d4cb95165
SHA5122a082e70df6edfb49a45967d152c8957eb6f2f1fe3b23af742eb288bc6b989e58c3aacc2083255bba68c6882e44699a9813c6ab67cc2e04a937265eab479e59c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513957acdb4042fea1e779e161b827a3b
SHA15a7f56fd8552cf8169e9919ee004ec305816153c
SHA2567115f817e0d9f03b67f8bbd2a3fcb3b4b648f359e89374d682cb0595b6e97b34
SHA512b4143ec898e93e6c020f4af58ee2aa80e1d5289ac0cea26846ab09418dc8d883245ed4665099d7db76f50a8ad33e58d5399696632f75615f5d3d1eaa35634940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c69d8b7e2e391dffe5a8e6ad132f4b4
SHA1c130222940bcbc7962250ae4898efe415d9e3b41
SHA2568e32a99f153a876214d19a321aedf61354275650858af1b4b9d961b8848a2a5c
SHA51271a7d335b583b8d3ab5410c81609306a4bd5c4077f7c5e27576a7d5a0f0e9ee9791024fa046e71823f1c3d51a006480b8d5d288f8352cf7009a9c3aba895bfa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbcd94d03badc9406e1f06c6a2a539e8
SHA1b9b165da6b95296799c091e8e82bd340dd31e777
SHA256c0c8dc0f99b5713f167b2227a893d8de797b70eb43848d9249a0f7168f435e0e
SHA5122e513f2df4242d03acd82b27a594f7218dc4d6a663e5aefd12558b5d87a70516e943af5d56b748f89d4600256e0180e1271394a686c77986457c8b3803edd95e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a3988128e470bda2a6fd5322c7ae964
SHA1e4d5ba017e42670617c4bb84a665c51c5f4bd97c
SHA2562579ff6bc997e4a2c5d62c46fa4a88e49638f58b87f7afdc2b2126217d6c19f5
SHA51296e580b50f312bade1adc0b69594d9b1fbd0c7940010847685d2605ebdb37457cc7bc1ff5e00a0c9f685ede9104702daac310471dba490512c0dc2fa6f715430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545f170031602d99c21b8a263d34bb864
SHA1679c1712152a58b07d21c468ba0b3f9b486b47e0
SHA25693f240f59130305e397cedf0a7c31e9aa93008f334abc469b9c51d10cc780426
SHA512b61d21a4f1125679fbc3f13c3722bb68135e7a88099fdceff03f358f0ecfe807c34bf9e322d1fdd9463f6e209bd3a635aaa8a217cadf619cabaf9fed9895599a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52198a4a877aaf4cc2c7fb616843a3ffe
SHA1e1e487443cc1e9bdc915dfdd2b136d4a8f162278
SHA256f194ad0914c389c3e383ae994c1a8ded6a0fcb179e4aad0cb96df2dff05b3614
SHA512f04cd7226effbc9bbc9bd05a24cb016498e8477f937b554e58b336f1637c575c4dc1cc0441fe9d80e0d78084a705d937ebc2108432daacb1ce6d14bf1638461c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f2dfe40d5e52594aad2ae89b98036c6
SHA14ba3b9042e806f935d8a483589b5f898b9ebe7e3
SHA256b8a30c9e59d14025b6e28165b052125567b08261aa51da4c1837d7279c77e434
SHA51201bb2f3257b82a7c684fe3c4a34373b8734f98c80ecc4c2c25d1c5a2bd7b76038d08d40672a54a7d09ebea85ecc671b00f842a1dedf25f0633945aa7024ac749
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9660638fe7e5c242ca521abf2942c4e
SHA1aeb6fea8c732341c6d347c31d2c59d6b30898383
SHA256f54f0e5e88542ca49db5fd9eb439cbc0e5d505cea994526d23bc8b37c41e3d4d
SHA51213cb44614f31c9cff754deaef1bac1ae1a433cc9bf043aa8fd6c1ef1d86b52213c9d0d03dabb71c440d2711f688c031bdee20d0283c80974731a15fff85cdcc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd579ac2e4d767e52bdb439a3cbdf66d
SHA1328a781281c2709c6367fee7e62aa893ce96dc28
SHA256d5d8938921bdf774e71b3b5f77e42bebb5508ba81b7b8bf2634638d9237f7f70
SHA512dc8c3b0f561a18fccc5c055c65a9dec065eb1b3b945825f673734a726fbc5418b81f2239b3be21831b5fdc93b1c100cc9cf9de94a60bda05cbba10d8b7fa4ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5789c7ae61d12435e15c309beda4ef92e
SHA111ac2a3ec2f5d2da27928721e9ec998dad92f838
SHA2565a7ff0b7db26db72028fd648092fd45baad530f5adbffa9c6247b0d79387e0c1
SHA5127a4d21f3f81cb07c31210c1dbc1613c9f71007ac57661446d2dc44a24b1d2a2e11d5cb3cb44c323d8490eee1347b78f147f061d358e002537599e1aa5a0dc397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5812125a69c3c605c865d57596951530f
SHA1c767ced1586f9a43ed0b331d7696f01de3196b37
SHA256880176e63b8335a2e1513d2ba60eda36b2061200381b84d751284b2845464f33
SHA51244ae2f2741e7cc559ce4fb747acd4726a4e7c24ce7bd593539e993fb4a2da12b6499d4ef362494e747ea8e7a1d9081361736abf7d98e629a8eefe5e4ec6bb04c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557e159e9c391f6e2eed530258a1d6123
SHA145634660801be0e89b1e2d955356c6aad23fdcd5
SHA256ca71a7c277e186576ca3e40a8c47fbbbb6908f0575767ada2f5a28491ceb0c3b
SHA512264a4539e796ef4a507edf51ea7cd3f6cfea352424c3a710cd619f4bd4dd9afb552c1ade729a1232837ea1f11e3f8e106a44811c15043ae1dfab78a705a9a3ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509ee2c9d59426501686c55186272f437
SHA15d4c4527fc48fcc3e8363696b3432e6de73a8e73
SHA256c73394a86640bee21e123d6a4b8d0fc74283852cca9e69669bd5847b689aefef
SHA512bf2a0c3d289c2fd51123f1fca4fc7b29fffa284d75a9017a92dc97c34996ba6a3251611b403d24488d5b7a1d0d0e947391c772a73de94c49a5eac2c2c8bb2a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e72a3e89f4d3f1e0f7e35596d9a27681
SHA1cf8c999bd637dae2dca775e7c10cab8be7fff1b4
SHA2562ca1f61d3803cac31f28940efe26d10789c0fec6c416a885db2ea67329d88a50
SHA512a7e34dd6821801931d559fdd552bb702f6ea662586879dbc6dae4fc16a153d9d71b7186f2d7dc06b19f96ab5bf45d348fbfdaf1c59efd12420b679f41765401c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ed50c54914585296b61671af15da368
SHA155bb4392421370cc2fda89eb1151332b4d11779d
SHA2568f4676ad64d9c8454c7a61fa5ea56af6aea812b5e6286917832ade98f5274cd7
SHA5126b10246d4842bb5f3390e3d607bbb2a1a64c581ffc2e74029de054d304e104dc493d2eecb4ed240d66dd8b2dbbedce9d7ee32cfb1ed8ab890270911b83bac71a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a8b30b66088b5ec529245d3176d1b6b
SHA13175e1eb5c59a0c9be6be08e45b9cb9eacee472d
SHA2566f8ecb3ae7283dbf6e2e4d9bf9bd8641b0fd7ce5f631e4ea661759a423edd116
SHA512a3a4fbf3e16c0ecc0cc0f6315925002fc5306cdc12408a7d7577ed03b06f17fcdeb1a7bc9b79b8cb62c7f8a250ad8e82228a302038c115f8b9288d732e6a44e4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b