Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
ae8239cc266889ddd635a02744abd73b_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ae8239cc266889ddd635a02744abd73b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ae8239cc266889ddd635a02744abd73b_JaffaCakes118.html
-
Size
43KB
-
MD5
ae8239cc266889ddd635a02744abd73b
-
SHA1
d624e4b8b07d7d3079feb46fdece9d1d994f4098
-
SHA256
70cea50a4a87772725c4b314cc24cb3d9d1e4a0f7b778f08f3d081d955f82a5f
-
SHA512
e3bb2df4f8bd826d5bc2ababc142fd41272df821a8d5272de404f58ecc6e7d4246fb7ba1487427e5df0112b9ae4b6731972c0ffa3a59f14fd8a8ac99196b2159
-
SSDEEP
768:2528KfmjIXUFQ410zJ4EJjQ3g/73GP76I6RuQfTPac/l+e:2528KfmjIXUFQG0zJ4EJUQ/7WD6RPacP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005103743398c1b84dafee74afbaf875b400000000020000000000106600000001000020000000ff25adacfa293d94ba35b891686faf6523db6f17b8bddb7d2d3126695acb17ba000000000e8000000002000020000000be3e526cc0ae3b35f77ecb3e80f69bad405682d0085e18325e80773e0e5b6da990000000b171495fdaff53ee514e0cb5782b53b7804c34f153413228846ce99802346826f9909d298bae5a1f7a7909f841f8796335743fb4043397a27eb8caa9d283ea552a752c291f667bdc6ab3d2d3b42ed5cd059593d8c8c6d9d21ee9afc8c658421a041735a6f4118ea3d9e319c7aed535eb44b7abadf36ba7f9462cb04c83396058bc2bf9750e334f84e21ad30060415ef3400000008143d47fde0fc7f45978d50a7f4d47e915d64eea4eaf403da313a349881d377fa0524a5c2c4b3400195f74a84d5f952eb19e2c604d980b12cb448b11f819c706 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424617755" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005103743398c1b84dafee74afbaf875b400000000020000000000106600000001000020000000eda2ed0177fe0ddd085ee27e55afdda71ed91e18d469f693dd435f080b6dd21b000000000e800000000200002000000046b4aef5afbcab979303656623517ee9ff11f37b6580d17c36a93cf411eac6c320000000e34c66f754deb64fa5fa9ea70f0a2cf8dcb9a1c5923eba0885e414e1133dc45f40000000140599db222879fc66d80a6e563c4581abf32d136b9c4aef7fea229ed96fb2fe7b4975dbda27df6d39d47a6bb655a5755566fbf34c68d0c053acf9e4ab03275f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAD40041-2B15-11EF-8A04-E6AC171B5DA5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603082cf22bfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2112 2364 iexplore.exe 28 PID 2364 wrote to memory of 2112 2364 iexplore.exe 28 PID 2364 wrote to memory of 2112 2364 iexplore.exe 28 PID 2364 wrote to memory of 2112 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae8239cc266889ddd635a02744abd73b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5772bbc4428ff7537e3533b4f91e918e0
SHA13bdb89a92a13b667ed71634b76937f12e925b8b3
SHA256906bda00746e0559f5d9f7c079cb4019391953fec850a892508624e4a1c68675
SHA5123520def9577d1594927d46e01b7ea58fbe11deeba47b21f5ef791087cb39b2d4d607dbc2446c654e997f8f485bcb1b8eee9a223e1553994c9fcc871f58eca769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5667b3827e20e85e092110e78a64db4b3
SHA172a6cf07be5100d30386e9e3fbac98d0dcde3990
SHA256dadf3205e7165b8f4bca7f5bb8352af24f2dd604aee0829bd2e1a04e062516f9
SHA5126c5c8595602b23834ae6b0a9ab18a95c5a8fa94af700fd1b25289ce7b636d95e6065e8c9206161efc5fff623b4a5462c22f50f1ba74cff1f9ee5e4827164f433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556d077ee59349a8c33020189291b06d0
SHA1b6a1a630a0879ea89220b9cb49aedf9e02893348
SHA25687ba0fd352f07359fb2769c42e38070209355d57aa1ce705e53bcd7e40c1fa61
SHA512aff84b300103e6d7bd5a94972a6760def247fa33bade8d65ecabb34ad9341a67c873cd68367bfb54afcdbb9aa6ceb4ff1becc8f03c82b339135060dc472dced7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5510880ae2b295ddd2088b717489e73fe
SHA13ef853e8bbb583f41c835c78ad59263a3994f8a3
SHA256d93d2af25ae5624ea1e071de48ce4ea272e1756119b0127a7500eede4eda0ec2
SHA512fa9fb7081c85c71c1f628d00a2b5a5a9b4a85391bd77519f2501b1827cc23852ccfa0bdde07764b060372062a56cb41e4ba3fbaba96cff8d2d714af95efa36be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ca7c06b8acdc401c532b380ab4e571
SHA179f00226146e476c9d0d757554c1fc54c9f99adb
SHA25641c938cf99ac214f3ce97d7a17e3f574fc9798b1d5526d20442c0110a9eb9435
SHA5124cee90462351fb3810090a8678bc9871f14bf1554cc094531bc307aefe55d7d3d20614e477fb080035cef1f16169a4135dd14e87c605620369bd92897d332249
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5628e4133ff23131d3180e87826fc5325
SHA176060eaf2655f810d849dd196d96c9f79eeb5e93
SHA2562bb4198a8111ad5bd07ecc26ecea743738a66aa280e246e73cd7b1ad50ff6425
SHA5122a484ad02e0ae75bccd5ac5b14ec6a4efac6571657865f81ddb435cf32c2984042d34cf561ca30186b34f465fc4a02fa67a1a30152cde9a68d2b5e01ac496588
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569adfaf8bf7670e73d42bb35926bccf2
SHA1b8b6df43e6a76e502f5aa9a5a9febe0af12ff99e
SHA2562c22ab020c6c0bb54630a311a077d0c6c29937c88d5741e1c1e293e9b05d84be
SHA512623acd48bfe110ba749dfa468b87c2fff912c358c09737555970668b29f76f4ea5ad289f21326ce50c75942141ffb37c428ca3f7be817b7d1b5e18bf1fc58988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f7ca1b9c583b9f85859297151289f3b
SHA1db41c6d0169b0b97a59b3eb3ca14864eb176ae28
SHA2562763c27d0d1c75f45c8a7232b60655292d0d9668c8a57c50a58105ed3ff279af
SHA512efc8f45667e0c3a6f0857f4877d911fd619a5ef5576dae068bfda5f492c0057fc1df2bb43907c4d43c03891c8a427ab70e60d0f62400e9e16a0d104a15b2012d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588a283ba2789124214e1aa7593e8bf26
SHA131327fee3eb761a931ef14ed07c3ac4fb17325f5
SHA2569a9a53c2b6d81958cc7fd9340e26671fa00cf5bd6f525a65631f80c2e06d3cc9
SHA512b07d3a2f26de2dd3fc6fef7c06757a19695034777f789ea09d25089692c695b4fac550fbfdd6f74bbffeab930aaf544d65bc69b3e5a47a40f23f9242c01aaa8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb77431e97dc9becb7ce57e277dcc335
SHA1a2ec202a09df8cf726136e314d47097bbda3b954
SHA25634149e66df2aad23de712f221ef346a5c55077fef64abb7b049329665cc97661
SHA5121bae0daa28f92d8093b65e27aec7aa80b80114f8ce9bdc62c3e530ca8af09aac1663858f99e94e1f2abe038a6af3c655509ba3126c863ee4e29afbf23de4b867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585887a8b72e860dbf99faeb1f8139a73
SHA13eb89452a2f0d221cd026bc694997f7b719df068
SHA256610a8aaf6107ccd54b85da316af7894c0fb5786773171650f3ca0a946dfc4a1e
SHA51241c3e962587fdd5e3136495684fe617905032eeb75ae51272cc005020374f6ec193ac5e4385dba5a37b6fb91456abb0011bfdd32ee88e8c9412a345b249f3ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e760a2ffc36363de951a09e45a7715b
SHA1c3d412ebc10228f3f09d0328d9fb4fb18fe8cc8e
SHA256adb4b1b5681826c534489a9e09959bf7dc94b8a9da5ee4441d781a6939004ee4
SHA512eabcad4c490db76cb61e5fa4126e97801d02d945191b56be1da8158fab79fbb786d2fd74364900e22eedcfc0e717a44cb1660dba9a77817ec911a1702abb7ea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fe2b6ddcc47d02d25247a0a0961dc2f
SHA17de118f9580c8a542f87aefbf93394e1d501722e
SHA2560902ac4e1b13cf6dfb293c02dbbe3ddcad30731a8f067bb7ff0a9c4b61ce8501
SHA5121781f82e558fb005b99e46304290f718970c80dc92d37a1da1d38c6b87245934a7257c89f7fe904e5d8830756a9735ddc5ed95d31956f0007e41bc29281656be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd41809f165da8a99debe02b2038d21b
SHA1311adaad4e3cb696c244d0d70db4d53996bb539e
SHA2568f0af0215d6a31f712408377c29c040dfc2769702572aec18a38992ed470d71a
SHA512e59102ae6cb7344336afa8a5a5a02340aaa730333a8a6df23d6a49e493b56215534c5a6b4cf343281887c2cd7d922733cb0ddc399f975abd2be053f91632d2ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6f05cba856c8f339bf4196d277a93bc
SHA1819d36680ced3f43943ca29aabc5b911f3aff67b
SHA2566e7042e8d43d7e927f0346c4026426984f4e86802e5e8ba2e228900112630dfc
SHA512e57774ae8100cbbafc25a01fd7eab73799f1cfe7f317d9400b3b1edbba2cdbcabdd26c87980d21af558cb3e6f7672453dbc99a000caffd76ffbce51c2cbef4ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc5bd2d60b05837e0d2ab3f6514b2e79
SHA1576dcc9ffa5a35279d18d21e0ac7baf032bc5e1b
SHA256a0e73810dc54a486291521c2433daba472b2a12d0146f6003776b48807561543
SHA5121cae2fcf9c8540c4562a6039866ddf93238c25fcb636ceae13feb905d57ef03ae5c489082aa597befd87dd218b7bc254d1c6a0ff16541eaeffa997a75c56f263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c79baefaafa9ecaf9254a14584eafc14
SHA1d83b28fbcf8e6ff540137b042d86459cafbe57ad
SHA25619bc8f26eff0e29669e0cc1205cbd3fb25e9b1bd176d8ead7361a4bbd4feda94
SHA512fd104f73a82edab08271fb6919f78f429697c6039d30987b878b6379fffa9e34f98731b2c719a267b690770d1ecbe9ccdf4399c14bd065c156f8fe92a17ade22
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b