Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
9ad532787ebbcd96cb19a01e053cefee_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9ad532787ebbcd96cb19a01e053cefee_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9ad532787ebbcd96cb19a01e053cefee_JaffaCakes118.html
-
Size
4KB
-
MD5
9ad532787ebbcd96cb19a01e053cefee
-
SHA1
72b07c2afbbc71a51b854064c437b86a937f3ff3
-
SHA256
68bf3ea96216b617553b0d8903f666b04b584a25071aab62de0ff060a64e25e4
-
SHA512
fa4d200736ee150efa970e96d25d369fc55c7d80c7a5cdff2a06121487a8f3dff448f8c5b98d57be86bb5211e5b58d6c60de1c42455f8d08ecd6254a456c17b6
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oToiBd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c4fe213bbbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a3ccca2c10a08478c6202480669a773000000000200000000001066000000010000200000007751ee059958c91d6ff2158d62633aec804cbea80f3c798364bc8cef4e5433c5000000000e800000000200002000000022d063ea5e1a635ca42bcb526737d527f423ff0259d6557124d6f44f6aace625200000005dc1bcfbe4dc8b8323ea7e9fe0a99b75e68aef4f960d2d81b45a976bcd3818e9400000009c358bd5ae117afc9f281fb32c315afb765513bba1d764cfd8ef49b8961550c601fc780b97c3e9ae5d21bc204cc236f06e1b5e762e14e3795aa5713305430501 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424188397" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D7BF191-272E-11EF-91A4-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a3ccca2c10a08478c6202480669a77300000000020000000000106600000001000020000000ef7df7808e383347adf3531a958a86f3ca981cfa557f1964a2c065892f716b26000000000e80000000020000200000000ea24f330599f7031190fcb2030a8d8e76782313a16ff2f3ebed90d89a22d87b900000002107fc86e6537a2e87793ef36ffd21e6f0607650575311da4100a033c0822995764fde7ac9cfededf0b4a080a08b5a61117c292e2c19d53037147b1b23903075aaa16e1f2bba0dfb85bbb638afeb6d5816bf4f0e4c6faeb400a94de446d1191a38c4f7f10fd3fd6fdeaaff8ddcabd3e0c5f1a22cdcc693278567f85629ecaac4209f3e01d6b4ed93ab59f680a37c8a50400000006d5d15693de54917a16976680febf3b07a76159893e9db25e395a5e5272c4a86e73337c423efaf1919b0d8424d8e1d4d2b02225ed83b9e3a19e0cb8d86fd3287 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2172 2364 iexplore.exe 28 PID 2364 wrote to memory of 2172 2364 iexplore.exe 28 PID 2364 wrote to memory of 2172 2364 iexplore.exe 28 PID 2364 wrote to memory of 2172 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9ad532787ebbcd96cb19a01e053cefee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567eb426e91ecc79600b956b0e79d3b22
SHA127706593575998f961279dfef8f5a76046952dd3
SHA2560e220c4a4974475d8a3119141fa0ea50143ce21e6c1479024202cbf02bcc85e3
SHA512f21cea8ee6f17a68625e1a54d53bce913961fcafd10ae954bfd262cd7746943bc63f441ab706c0d6083d3d54e6eae5cf250a28a6af6d9ccdf471554df0e02080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dfe10480663d65124456e084edfe9ec
SHA17c64b6f8bb20e4efa1c4cd21ebaafb968d8601b3
SHA2569ec7fb8c98a4e005ab7b195a9a50a48e1828ad9f8f62f485590885e136932360
SHA51256db4c23cfe811eb2e782895d08b4a339bf6b46064bd8267b9b986e18e4a3095165ed32c299915ccda632d8aa8255d9be76c7aff64b36a68b3543a9fb8fa29a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f702e8bc8bd4fb08a67aafbfbd66b89
SHA1ca4148d49952c46dfa356c4ff90b355c29127861
SHA2562e2c097e631d5625ef2ed8e3e020546aee9470172291f41487d335315fce8ee6
SHA512cc4899111215ffdb3b388788fd95b7981b195843392c8cdc7d9fafc2a11227fa89d690df22b7624376e0f83ca48110103fb5f670a421d0a2972b14d703d7c971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589e6ac1a25965079db0cda6a7ebf96c8
SHA1a74e9f52cd315a2c06edde0136cd930906fd2f6e
SHA256d4ba7ab16ee74d6ff901ec1ae4ed1f22afedf55ac5045d24833c269782b69b47
SHA51247039306f43bfae4fb0e2c10c9bcad40e49ca9214ec1519fe2e07b852a63b7c670ffd702128b748616392b434d0101a263de77299564eb377fe393ad77879bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586df187c1374e8b11de3911d0e411391
SHA1157665b5a01179c26f6d427ec2382812245681d7
SHA256586f2b6e9d9a33f75ce8c6dfc901a619bf563389e11eccc391684fc4beb75797
SHA512c62fcd0537bcc4b8dd2c22cd6a26c35b38a63f3ce106ecea4c652f848489f885f51de38570a5ef0f1eb24719798120989540d7b553f28e1ac6677d36cb769aa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5415347143e5f9de198317b8e64953472
SHA185263ee7a474af1b65bdadd705b0c0052d22275c
SHA2561f0582a866ef55d2809882911bbba24230884c8cd02e3bad7ca0f00dd7ff54a6
SHA512a698289f53509068cbef64aba08c22abf412dd94a293c05c8a12f432f84fb158a5dbf7a17be6004c7fb280fc3545be5787f963efb4d08c3367b1fa14121249b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bdb8f9151071cd4d1c069f2b6818419
SHA19c8e3c83c0db9d4f4c026da1c097325a15277be3
SHA256f1fc41f52ab0d08e2346f9094fd188ee66994ee7e5db1376bc4ecd5049efb018
SHA5127119444709bb429d4c830c3636c18eb05be6ee42c2cfde5941af55cfa61bd22d695ce1190a73ac073e837a6a434fd38657836a669f52590fa4732b375bfdcb9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534ed70c679e14e5b1c40b252c79be7a1
SHA187a909889a98521a516cf8891731410ddb64f1a8
SHA2563dce3496c3ddf930a1a04ab5afce8acf381f21cefd04937eb1d39e055bdb85b5
SHA51278b176c526ae31f1e78301a611a76141d86b8038c9090cd1a9b05f197f792d8f16b1caaabd596c784b98c230268bcc0e64c6cb85e07be4c855a5a3ed61896e8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5515552b13bff80804d97d7a6e71ad6fb
SHA1a56a0f726620aa445d99f7432f996eee472b205d
SHA2562d53d1be7c1985b181b5ec417199fad96bb136500ba0566593081a3df95fe1b8
SHA51255a9aeacb7cf6830d652be4d8bdf2f064ef07db743edb14077f2a7b6a2c4c6638621139cbfc0c0e368a5e367d59a0b0550566d288cf9b72b171aba28c928a7b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d5e08851b2389779c86eafc5caac8fd
SHA17cbc9cda59ed0747d329f71cd190651081da1371
SHA2568118ebe842ecb35589a7150a34c855ccabc5d966376b692b9640bf6b6439b7e8
SHA512112b38ba043f88748e8e6737b0c3561c77a3393c85ba1caf31722dbfa490a34981c28f413626e8203066ce6b7bc7fb198d8ae4298d326bb4c0ae7c6a411a6dc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51786ecd41d443434be3e5d22d2cc1b5b
SHA1ac90f7884a67158309de21e66305ae4c601d748c
SHA256dbcb5a8841d693210d0d14d4443561f5795841ad767ad5bf4dd5f14f9090ea8b
SHA512ee9b1f5729fba8c32d0c7b18b0be9994ca49f1256bc7ac65d7d305c57b1ab9b9c9662986a1ceb0f8e67988f0d27c276f26c6fabdf6452ebc415ea5bbaf88f836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5038c35b43e9ac9f13032b55941cc0a09
SHA1ca57384e3af5997348547a456ccb5e70f32447f5
SHA2564d7117ab19d214d701af22a462876a87334aa7ae38bbd893eaa455f3cccd8a35
SHA51231a37300f8463f5cde253320cf2171ed1c2351d0dd531e9d0569d092cb677d24637c3d2bfb5ece6d1c048a3cecb5c36e95fb03b26f1c6b825e1adb69d8605c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4de05ab777e6ab96e4865ef87946b8a
SHA13f7ca11bca9318295557ab850b99bb1128f2f856
SHA256551171f6522da00d6e4411fb4e18d6a3b95c485d976cad8c5d2195e4e4acd773
SHA5121d23e73ccaf41c58ebb659fb24b1d9033124a22b7ea4b24059ed6ef5d6ccd14bd5dc59783d1a87578bd9245bc9026ecea609d5f730ab2505a0ee965cbf36c427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0712e560804af6cb9a75cb95f9b68b5
SHA1bff65d4ef9c044ee851242b4598f9084cd2d0b41
SHA256fd505d18224830851ef863ab37674740d6cc857acc4bf12a467c7df0580aa5e8
SHA5124b3671190d9e3fb11cc3a23f038699646e42ba01b51091f059dda385bc12b1aa24647cbc2ffc10f9793bc0c195f0c36e295c1626df7e07ef68fdcdf3558e8707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5debe0d9223f53cb4c4242864747ecebf
SHA1028f6ff578184cdc6f6f00641f262dcf0fddd43b
SHA256841d3ab6bb33ac6449bf5ab7b4374d415509634a7fc9f13bd076cfb9ce81ed83
SHA5123fd8dcf7ed0b1cd3d3aa415a1ea0be16a99b12d04e161aecb07350503cd7e82d2e292c5f00a8bb8e55ef74cb8f2b796566e4ce009f099d8e23eec5af59f78bde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524a8c701946856b29bd2cf298b524def
SHA1557587faf41727a8befaac8a5023b31b6e79b40e
SHA256f08947cb6141fe166aeb59badb842aa32539bfcd7694149e0fe9d98dbe8b7235
SHA5122b193a90a87270695a68b3272821ee2c689398eb34ad8258b814517bab9c9086f2480e134fc6ecf5b17912ca085963d50f3e80b3bb2e754e2944a92d999b0553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c14c9bbcd43eb6acc9e59c273296fd9
SHA187f06371035279e7a36fc24024b1b1d0660aa49c
SHA256b9f7f38bb8c139ce8863daa9d559b3ec66ff040c49b6ccf3a4c3243b1741b8da
SHA512f577167dfa99d7e373138d99b2bd619784a52d993720e67014bd392a01a402cfbfcf5dcf50f13a64482cc13777955736bc951b2ca1618bcf880d5c9b3ed87153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2114e48dec1a386b64c73230a5b5c7a
SHA1085730f57e90b39095c74ba2366c6d5066605cd3
SHA25650448e0bc144de09d444e4959969677b913fc57b20b4abdc260ff09cc3bbb26c
SHA51289c542b54e689e47cd682126af34486ba727659aa997c7061c40997d81c290e986c346ab46924d48885f4a4652a9c3638ca032909b230478fb2f0f26e7d47210
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b