Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
9aaea6b74d138a7f0b5c3cb7d2791ea3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9aaea6b74d138a7f0b5c3cb7d2791ea3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9aaea6b74d138a7f0b5c3cb7d2791ea3_JaffaCakes118.html
-
Size
6KB
-
MD5
9aaea6b74d138a7f0b5c3cb7d2791ea3
-
SHA1
4df0639d5523f447356c27861c55ece48a9f83f3
-
SHA256
82b08b1c90cc995092bd227b922a36d600642f4332976c806fc74e417fd9dcf9
-
SHA512
374b42d5933625617ace2ebe310e1a9f25c8e0ddabd3f56ea2ec803485d6783e0847d43e9711e7e30420b4581d0b135fc2a7f7e7cceaa15eaac7b03521903457
-
SSDEEP
192:jbbpbCb0bJb6bTbEbOhyDcM0tMiguxbzI9:vbpbCb0bJb6bTbEbOhyDcMm1bM9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE4E7001-2725-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c7ad69fe0e5f54089980f5f11b5cc2600000000020000000000106600000001000020000000beaa51830ad9981c678e5925fe6c3f43222a799be61af47c366574f241bd8e64000000000e80000000020000200000008ae9d16df4fa49d2c6d28462e8b3c090eff92a9fb995e2d2c81eb03a6c3716092000000088aedd3bf3ccde05b8d9e07a08e9d6731311d10729090867576421ecefc23af340000000e0bb274aca76bfb27721e9e8084bc11bf5a35b167a2d0e1771a6061e845cf8d786c0cbea7d122b1585e90919662b9accb249954ec0b670f53d5c3e9b99b602fa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c7ad69fe0e5f54089980f5f11b5cc2600000000020000000000106600000001000020000000b126088d05794c31e19dfa4658d539abe903a2cef594f1803172212cacd98cba000000000e8000000002000020000000838ef6f0fc3547ddcc2aab9ea11548e041c875e352df76cb0064f18399b924cf9000000081a0a57cbbf592ed005a8d0f4d4ff4a8b958121f03aed3dd0037914917acef028b7230e7d47f6265b17423e5831687f332520ed5885fac1aa4210a72bc90da18e223b086c78076b426f05b8bec70eb8f06102382d1194120f4c0c61052817ba2717fcd07bd7f80010e71c4470811d1cd851296fe78f7b73bbf5ec52fc9d688e8a46ee5a64558e50c12b2f3253e59c8314000000021cb7b2545746a120d617a1186a04f6465cef1e52ebb1cc75279a2463217af82738dc3b549c818402f0402b417e88cb71420d734e80f89ce36e834f95cc00ae8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424184708" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e6807232bbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1660 iexplore.exe 1660 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1660 wrote to memory of 3068 1660 iexplore.exe 28 PID 1660 wrote to memory of 3068 1660 iexplore.exe 28 PID 1660 wrote to memory of 3068 1660 iexplore.exe 28 PID 1660 wrote to memory of 3068 1660 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9aaea6b74d138a7f0b5c3cb7d2791ea3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590a3a3dbc5d05cc20b5c7c3d81dff8d5
SHA1b7b3608921af2fabedc80384e6bcbb2c3e59e935
SHA2562dc09b580ee49f66d27e2057398bda638bebd51b8d373d9ef6d61a9991d29f38
SHA512569004c4efd7e8ced7bacc2dda613224ef3028682e756987f9575e197e2d9dbd28f84e7f61a0c7a93ea9ff33986a3d5112c443ef479b04cc7f2c59160742df95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503e94b8c5912b9b615765481d1a0f3cd
SHA132d1f6361b94d1f6469440eab0f93d7c683e5bec
SHA25645e0ed3e58ad216b1fc6f496d86c7d7bdae318533ab4b4209c767e951898455e
SHA5128a6ed30e38bc791e1db7aa59d1a5ac8747d2a54ad7475759be543790608b8ebb1f668cb45658a77eab07665b864a9381c80cc922c88fce286928dc83e96babc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17c4f7e552b17577966fc247e75e160
SHA1c9a4a99a5efac180385ca6c17212108b3dbc7cc6
SHA2563c0cc09ee237f7144c75d3c8301df01eeace3caee4221a72cc3c8136f8d62633
SHA51280bb2ae6a1606583edd3d48152f99303ad87efd35f3695af008b507897a6ec58ec4130a17e7383c4ba09b396d2d5eece59fb3e6a8f68856ecdf6a94c46cf8090
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a60dcbf28b4d8078e499d3ecd19bb546
SHA1c1e0646ab2725de192064e65606aef5968d32685
SHA2565f0e1a842c0d688656db165b04bc9c1d8e0543edeb7f8b588dc7a336983c6972
SHA512077b9d1df03e77ce89083082308754de45d59f084624e0bb078ef24941be1ea0e26eef05fc1ff3b6c8bb26283f0a36f0f7ac7d963708fc8157cc151bfb2ef3c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508532d72b450652eef656b1c532ec577
SHA181952cdd4a05d9b4a1a6557f15b33350a257612d
SHA2563021989a568ec7ded39fabb42afb7420390aef7bd5ad0985f87bf666f1fb88fa
SHA5123fa45419926aa82c282d631c55ced22d0c443bb5886ae56fecf9b69a69a3ca61b46fad7038adfbc852529f9b2fa5af695554a1a350417011fbc7bb4d4d1fa4d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f7407fa106e19c6f7a3614da56ccc7
SHA125febbd64e5e2af64bbf922d5b3f76461dbdd0ae
SHA256e53f514a0bc9a2c0994fd9d37fc7dd15c0fecf6a2a04d6b5938b01c69419d086
SHA51246ade9999321618a67e355b3019c42b41b26422bbe99bec4d9578131bbf8fc9ad30990777271cd403e7183dee008d0adc8133a73aa941cb08ead885014fbbf69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530ed56d10859ef5e91ce91d05a1cc9c8
SHA1f59f21df83ce9185b13343a7388117f792d7008e
SHA2561f21eb9a153b08ab92a5bda1357718af7b174ffbc4d214361f624338990c85d9
SHA51287b5bfdb031116ef17426e2d5af1b421297d1a8891b116a1b9ac04dd8dc8a9b28a82afe7b4125a64596f6b82f5274bdc8199f1ce2c2a0f5bdf0ae130f22e947e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57947288deabac5edebef813634d5fda3
SHA170b603cfe34d6f59ea1d3c78aa4895377b75a666
SHA25609f266d0fdd2ce12efa8a168498cbdec57ff3af63f4fcc4d4e603ba2bbc516a1
SHA5120315a0e03d170b92727626927a6c4cfdc8b3a76af89b70a4a984a5a7bef7b0950f9e7c8ef8ff0b4e956c921f0ce3901042adf87fe48b668ee6d107681e8f5e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e79fe7f883df4974646477289a720368
SHA145c018fd1a9524fe1280765210427236870c2aef
SHA256657dfd8c9fe95018145376ab418ccc7a10e4fc128a48fb97ca89f13f856addd2
SHA5121398e9b0d924bdf528e65447058c6181614dfa207fbcf520d7b10c65d223a354699d560033f35ea20c141e566166e540ef7f153efc953e64f10baad0ba10179a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af8998263412cdad79a1085a896564d1
SHA13a2a9cc334b3f0c0373a7ef61d8a28d440ba8310
SHA2565acc4afce3a2154912fc2acc309924f3be731743ca46b0cf33c7437866b6eb14
SHA512f92d7e17adc04d9cc172e014234312f42aba467e09c56e8350eb8e87b31190af0021722e9181c409397f49a5961be5742cd8e1097e45c0a5bc4ed983c73de725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2a39beb75820507c4d81258b4106035
SHA1018b4560d4fc13715518c9f30a8902aaff321c72
SHA256f670b9e7d41fc8a01fff7859c85ee43f149264951fa84e2134062ae19feeded7
SHA512592d75f46922db335865763a730a4b58204571154856667fa08ebbffc0e758b04560b9f6e39210145886860171070dbd6331257409bfc6cfd4962a79ad4102f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4dd4fbaa68e612eefc795faa51964a0
SHA1eeefb2daf301351173efdb935fb6cbbc4a0d3baf
SHA256581a7a1373bcf3ac92f5aa10cf5121746464c22d2b426af3699b83bafa0bc2b6
SHA5127a5743edc14538831716ffc6119992ff7b491366d7e2d64c1d6b46f4043d20713d4d12c0985e5de37c62eba4b54430a6fd359e2d55fbee25e69b5cab8cf999ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5595d93e2cc7d8664d8e30c0925b6bac4
SHA11d9f321b9276274d9b8f4fdb64937d7e334db109
SHA2564362003c4515f188fbc0b5cc7f9dbd1fe0a3e434ed3fd9f1b4f3fccffe1a6777
SHA512a8f91e2ce0e486cd6e54ca91e516619498a8cd075697d1ac14db8c7f0789a7c3248ef1044666db25056aaa0e872d22aad7d6ff74e2bfc8304be1f633123ca730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bba3d675a22ddefbca1f8d08e3410fa5
SHA1fa544f38c8e8db6b5b446167948520ac27b406f6
SHA256879f63d6f5a7481f2c27cb4e01070a4a8982e6b1ddf89f87634221c9bbc9a935
SHA512e94980abb99d2fcd4081f1aaead4e1856da331484ec21b2931f28055383f8c4024b8a0812bfc559071f5ea8112928067e0b1b4fe5ba197126b50a861dd0cdb88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4dd7826b1b63bc7c3db457ea49bb2a4
SHA199d8607d00ad40a4f1ea8d71fd87e57f0d2ab616
SHA25648cbab482afcee9712f0497b9894ceab8b1e5ffbcfefe98e55dec57b58320b5c
SHA5126f99077e5bbbbecbc347af8119af1224e689b4d6bd14122ebec94440f82a715a47d0a3544fe059644153169bdb4c572cde3307b549d8c5a5b3103689118bc454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564c31e5cca8a8a38202fa88d44b537f0
SHA19e86a4df4588c8df9251f8ed8889ea9da7f218b5
SHA256ba002543460d6727277fa633b6b72f6ec98e97ff2bff5bccca655d71513c70c4
SHA512b1bf91dc73351d4f7bd1e4266b886eeb349d4b01f88e469383d372b92eb099eaed0c189a43c138f78e56fa19973446f8d508287460ca9c98ccea4713d801a5fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5948de59d36ab3baa41c5ea63c3cd5483
SHA171aa8da2adccdde088209bbca5a0ee01e2ecec54
SHA2567fe68cab934e8f760b53b8edbcd7e491ca4270d4e4b38b21a6f952c86e0438a8
SHA5126eb799640c0391dc3197f5051a3b88a30d81d70f120de2ab1ef2f84599b2414916e8fee6aed9ea7eefadfb43dc495624454a9a102975088dbb3cd0f5d3bd8752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efcf10b4c61b63f3a1ff562bddb45bd0
SHA1164c5caf4039ba4c6265334eed7af4377b88d833
SHA256e4a0258f172ce8b0c199655fde9a33627b683cdec2174bf03c1f0e16a9ab1a23
SHA512c02fce5dbeb6f1baa117e03cb51386da5c5f4f99aee3ca9110b7667cf05ad4ae34968e451059acc3e22c858af903ab6c93d9a8f9e102295f7dfe179f099692db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b