Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
abc918b308fd54303b8e40577b881d05_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
abc918b308fd54303b8e40577b881d05_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
abc918b308fd54303b8e40577b881d05_JaffaCakes118.html
-
Size
17KB
-
MD5
abc918b308fd54303b8e40577b881d05
-
SHA1
281e9269d39b735489e586772244975011de7058
-
SHA256
19ce6690a7bc4223030d5079a77054d10ae8505bfa40bd95c362a00b034989e9
-
SHA512
e419f22f5ebff0317811893b3281cc682e346509202e395854894adc2457a5fbe6ecc773e00d5eeba41099052cfc5090797f5c29141d4725cfebb2b9173b2621
-
SSDEEP
384:xvyO6P3gsb8ySXEkCp9li5aOZ4f+JhCLSXS27QLKo:xvyh3gsb8ySXEkCrli5aOZ4dCk
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0458512abbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DD7F041-2A9E-11EF-BEEC-D20227E6D795} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929db8fab360b84c94be9dcecd4bf6f10000000002000000000010660000000100002000000017ab72bde03859e61568b9977437d1b90af1c37d0b34a5e3b6c2ad8c485ea0a5000000000e800000000200002000000097bb13a551b03a24eb8eaa091ee991b57f37ca370bdde2745d3c8e1e6b8b0620200000007b7b79c9be51f4b5cbc535a4561d233b2631a2ff50be07397669cebff673bb6640000000b8ecef2b46cd088bc2f8619b5535333bd93364d6719708cd0105c86b781ca81d198df08f4776efcc77a9d8a58f713fe99ab59144caf90e58ce088b1c4be307f7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929db8fab360b84c94be9dcecd4bf6f1000000000200000000001066000000010000200000003fbac569accffb63bb403498043ac1645f3cb9e5d0e68e36adaa917959ce9dc6000000000e8000000002000020000000817abe2e92e97a515616d9c1942a52a3aaee4fc5e61245589d7463f2c9f81b0b90000000c05e0e17bf4e92c9a02633a434efb553ce5a7ab2ac682d0e84d43790ca46714c15bf857d59c6592816fa2ee3407972f2ebd81af425a4a062947c5ce3ecbbac395437a91e6763cc6c50edbaab81671ed979f1a51158c2b883a1a2fd3768753145ee735e84399e1df8d348376f55dcc67e91b3bd2e44e21ddd5bc33ca491ea20e703ed36e8072a8b9341c0c7dfa6acc5a9400000005ec126c14db1c43f6dc5116c1c26a1310a02c2302380be3e4781bfde2b067364ff48d2206431f100437bb39cb131db838999ff12ff55fa486cf2c018cdd2517e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424566327" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abc918b308fd54303b8e40577b881d05_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b068fe06a9eef729c2016c2a74d89a1
SHA1279d390759f93e773b34d17602048fb5faea62f3
SHA2569867f10df7bb09e2b01244e75fbfe3139482eee52cbfa16c77e9e03c28e88712
SHA512b2911558c0fd95055ebbc63b9017d9f452215827f407c733044708b708d21940c2552db29b1f01920845c629adf3192ac2b74854e1417a66ba352d2050b55092
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c139fc3e7268290d459032d52271aec
SHA1caaade211d978fd5bc4aa59fb325ab968c637787
SHA2562aa22302f83fdfb021532ea0c12b2bc940933ee8477cedc800403343545d0dba
SHA512adc6b4c98e47c90411267734c0709bcab158d4614137b728270b149c1ed687c4025fa6bec88acf60e290d9f046594d41b42391a6df9e9668643d23acfb396210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fae9a2f718c76ef14777741afb52a794
SHA14ced7f74b4c61f6ece45dad6cd1da8ffcb4aa554
SHA2567552d1c045235d37e60460565651e5a0f4bcc91db799e073a0b62b1dd11964f8
SHA512faa25255dd9519f30d7464c3fa19571bfcb3c6b024d7578a2d2570f63cc9f4fc55a3f2271f8efd590b733df24ee591e682fefcadffb8bbf5a107f8e025735139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d41cdf751f3758eeda386361b9caf55
SHA1ad146e5ead033133a050e3baa1d76ddf77a984a1
SHA256fd0bd785ce473be96327d9114a430e726239578bb4bf932f3a95d9e625ba7aec
SHA51247d59f6c61ab87c7a81c2b723d888c6a01723de51273db9c91df6b1d1c0c130b9ad1ea5b672a3ae0ddf989ace2b8095c425b5fbe10f9e2a8335a8e7736ab2d6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b803361a1888927a70b36126e8daf2a2
SHA156f1bdfe2fa2e4451d7f780e7cb712aee8881482
SHA256daf2bab570c5c78d23c4803027509b1225d2cddc2a9c420fb1119a7106e4d838
SHA5125362a53877d01423fe6a97819060d821cb35292c948aa562aa0282c4af726c57dd5ff9f94abce044276286135c4608e25771742f7340428cd67f25a3ac56e92d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5346681a752fc2de3c9ffd68c6602349a
SHA1e0316e50b51b04cef5d5f92d8dea9d6859ab4b67
SHA256b6c366be37327345980a0e3ab682fc0e66f2b20b209f10e7b4ea721a0cf6402e
SHA512539d7158fb5282f48199f6a560111b725b1a11be97737cd26c937931060fd9d7ead6c440bc4f4d0e061aad27e37b04e5f8572e088ecb6cea58fd86dc04396394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a50bfea73e2a1070e1c410560001910
SHA12605b245a1dd6055d90da396511886125475765b
SHA25645b0f8cbed7bf1059c3b6902978f005c09eef0e754fd416c28348f242456c4fb
SHA51241d96e2c15dbf625c60d14e56f9caaa1f387c5617b304ac1bad29bdac098ccb644e3b4e5b21da999a588c981de24604cfb9554f40c4fe2c2f689b07a8f4c56fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e977e39f5046dd6fea68e05379c77a51
SHA1ccf687af40626ca70a0ac75f9fbb34e8d242dfcc
SHA256680b5afac2269c4b3f463bb479d0d23fdf5a258bad03c072ec412f9762831b45
SHA512d492d5d34ba8a292e1c1a8e66ba83456bc002019b7a70c860efb931e2474f41c694823ec218dd202d287b7edf9312de8097b4ebfb31ef2a3ca7494ad5e3b7855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a3b8b8fc38934a81372c6c36d52c3d5
SHA110dab7eb07c6bd0f7579c70e394c5cd094b47354
SHA256eee8b671af5449361ce944bc46b595d8483ac4fed13cb958eb2af5aabbafb69d
SHA5121f0578f50c847628fe14377b6cb2b9431bf8e188bf70b928629a10032a33f594919f23a17deb632a49d36b268bdb4c9c209de9bb2e17f7d7fe8cb019a346af8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ae1f16f4c837b93439204d3df89c9a
SHA1527a3bae76e5df95c8cb5e20accb46a5d551944c
SHA2568e6be1d9ec36cd074f20784367785529f96f200905ba3f8f19782a2ce08c9566
SHA5123b86f7c3894035a436e8534d49bb6e857c497e3fd63bcaf388a88f0ae241fad8396d86ad869ea52d6bb1ef08abf2b5e166eb373ae0597fea08f3f8c5739eda65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ace6a241161540ab24b883898f38b5ba
SHA17aa97a451365372f3e419f6a307773645534dfea
SHA25653b41c384abb27fd9ad8b99c0c51554bf16f72aeeb58ea91beba4bc476be5ee4
SHA512d6d14dc9e2435e86c4b754b6c4b12badc20aa6654980df97c6afc6755f4c34b55bde6e38edf5ca5b113cc9e0e7df459beb6836f0b1431ccf7f55a6792543003c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5924ff11b86bccea9b1ce6858bfeb8a9d
SHA154682e6f18d20c033ab813615f5a95135644e5ae
SHA256423afb7b6ff896eea99404fe64897d3c5bbe26ddc6f298eaefcc9028aa7c3a4f
SHA512487d487854b05072f9e638295052c992f3d50074b7ba154d3960ef690ff5e0fa70f2ee041eb3fd6b12734b44fb1ac62842416b5a89bbeaa7d9ea0da36774a322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5276fc4fa37cae5a1f4d26a9edbd49144
SHA160a455507813be558da0bc72516e370e476b1fae
SHA2562a64e4c062784bea46e88b0f0c6ebf65dd8bb61b41fdb822039972f226d5cec0
SHA5125384932ab2e7845e4bc7cc45ac0237abd78a5317be2401b912c4a0fa0c27b7d20cf28d8022aa9721f566ad839d2e8c8d95cc5010d9a7c4342f516c44e4679cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c72c2f902cf4133bb86684110e58c33
SHA15a5d0771a092de823157e5a570e64e938d21d2c4
SHA256de4824761302f7060e98eba7537813082f00f6e4b7e11453f9b1bdaab966e5f5
SHA512656a18d6fb4b296d80a0dc75ea0d14cd34c56150711f2144a1795849f0333947d71c19259c851876ea402981f0e36888eba36a93cb9e6616b3481f17ec4d6d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56357de36e9dcac6a22b8c451edafa0d5
SHA1836b0e202e1bef725b460169b5372d371168542c
SHA256f81ebdd5e2e3971dd209af5d5f405866e8850f9cb8177719e4363f6b23185495
SHA5126e1acff47ec1c5853687154abb087f24e9a836c9909a7227710132225faa74e0cda9f4521b40f0a9e40b982fc9c57043b1b0088fc159f52035481cb28abd3c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e08ef4591839bdc5dd28410c53a3fc29
SHA13ab5d7ddbb8aa0f31f78d47c522a1049cfb69b5d
SHA2560b7140937cf7f77b5ecfed6cfcaf808796b41b88afc4d8a4fc7469ad78141a09
SHA5126e1519e29782097eee00ab26a19d37960cfc2c7eceb428572f118feb46ebd9b862dae6b7e8fd4d4a88bfe1a5949606187c85df9cf90856bf5a06ac8ea28a6c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b0e7afd97d11f7f92a8c3699a57e2a5
SHA11e2508bea44364a8f7ccf3255f294e0831ef433f
SHA256b2a6275c09f9a1a4a4b2dec8af163f3faa3bd8f69d14a6a62fb9c1175ed72020
SHA5121a30e31ae0968e6ade8a9296b465c8f3c640d817b7825cb4cd3765cb17f19e9fa428b839753be2e407dda6c473f39888c7286f2f902c542d75b2634c484df198
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b