Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
afc861ae528960a88ffdf34a701a5305_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
afc861ae528960a88ffdf34a701a5305_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
afc861ae528960a88ffdf34a701a5305_JaffaCakes118.html
-
Size
43KB
-
MD5
afc861ae528960a88ffdf34a701a5305
-
SHA1
3f1ec8ea586bcda802475c1b998822e7f3a70499
-
SHA256
f7b4d619865b8af9b0bd9ae3ca8a198f80dd79c84b3867be63121fbed2909971
-
SHA512
03c884c00c3bfc63d7f49095a5300311e4aecbab5967263560819fa6db57b570a84e5a3d9ea9836359799dd062d5bda4edf491772ee272c379cd93564bd3f316
-
SSDEEP
768:R4TqMcsOoK9k1w8Tu3i0IG4ORfPX1P9+Xz6jHLlVsYhAoy1FilsPd9ZI97nUR/Yf:/MPu3iO1PUXgAoy1M7nUR/YjEFwQRxyT
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{637A5CA1-2B45-11EF-87AA-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2a1ea5c638cd24a9ecaa36b81b9d7f600000000020000000000106600000001000020000000fc0bdea377f01ef60c0aba65b78f275f99972260d2e297aa01be679e1ac5cba3000000000e800000000200002000000020248b8c1f1bd28b32ec65950edd4edac64279c54f633240ab005b87e22c661b90000000f3f0aa0352a51432a1442aea6140ab34b01501d43730ad2aa09604fa5224a7151a85b343bdd77a13c25d3e31cc5f3adb71cd792d548217b753ba2f932e7113844ba19d19f8969f35229226b1eb6bff741753c442a017f24b3a08835976e1f27f2d67f38f962d0bc7eb2ea723ee1727bd75e6dffcccb085521e750631bf1da81d644d6bf038a0b4840426763d8c4e541b4000000072ab77528dfe1d6fe050ada1fc95e9e2cd12e21c098eabe4ad73644b17c9f457cf5fe5550638755807d9ebe58da16b61bcd39f9ac4970d9e2259d6eb18f6aadd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2a1ea5c638cd24a9ecaa36b81b9d7f60000000002000000000010660000000100002000000018121976a51a21ea403d778c0fe228114798e66b039f094dd8ed33f7cce9bad2000000000e8000000002000020000000973e86bd4e1afb4e1d8fe368d95525a94288d228e6e93dde569c624d54e24916200000009dcee26ee5ac34be148a59c42c30571db0687b0078e5075af8c9e85e3f51c9ba40000000b72f9277580960cc8377d88e659e8c347d3475a6cc58a455e097664174166786ac54e65de54063cfa31c650e430437bca258d18d55597c4120546ba6e64e1d50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c2373952bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424638118" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2732 1984 iexplore.exe 28 PID 1984 wrote to memory of 2732 1984 iexplore.exe 28 PID 1984 wrote to memory of 2732 1984 iexplore.exe 28 PID 1984 wrote to memory of 2732 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afc861ae528960a88ffdf34a701a5305_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD59e9fa8ec76a6f9741d9aecd1cc0427cc
SHA1f372e9d8fa5f2084f8ab6132e98b4d8d2fde1992
SHA25634ce4da4c641c4b8ffb040c9e834b8fa8a972f0bf9953f58c810cb65eb1bac3b
SHA5129ef1c6cacd2951d892390ae8bb46b927eb20a3128e595c3e0f598fd95da2b2e93ee55aee0baf06ec84cdc3f4647053e3503b34be48ea5cf2433464ffc7880ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4f8f9a88ebd30babc065585027c8b7b
SHA12334de2783a788d51c65cf0bc94a72222593df58
SHA2561466cee8eec5ac04c01b0db7c00ce3736b2427066ba58fa38427fc9b8dcc05e6
SHA5120be8650df3736f3c82b5d453a7c603f6763d913708978af1db440e5408abf4bab9a5820b3769386756a82d59148adf3ef9eb9a1e7516f5c1a80fdfe2962253a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e16b707ef62e562b85adc0826d829286
SHA1a761a22e2ef994654004ae37144dc2d98ce9a52f
SHA256db7697f00ef1b58a9abaab4e50040da4e37b6e64a00252346a635b7a8c168d1b
SHA5129918124a30a3af886a71c3fcc8fd9da9f6b305000e432124ab365ea7c4d20025c4f8671b8ac046956bfcd2cbc87e3bfbdc17a95ef0dd04f1cb5bbe8c66ed0e30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524e0f00cd31c5d2e986f5cab1dd744ba
SHA1c18e4f70471b3ae902418c5b261f1da768ccbe10
SHA256ac18c4d18d37d76dc09032bd46baeceba1f5f6ff9f67b8d9b704968a1f4b2766
SHA5128e285cdb9105732db2bdbf1b33f6f41324a1fc82cff27faeaacb93fef617e0ef106f97687e21557b00224a0dc5ed065b5e3b98dd50a1e6d86105bd83d370dee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500cd621b5260095be0b511562171b737
SHA13d2cf6c6d86f06edba7b5813fa2abd014ee1ef4e
SHA2563d3941392867c00af36de2b7d67f6c76e26fcf4df9f38b56677b832d27bd6f43
SHA5123146fd6ee4b7a3025a9efec509ec6a49d75c92412513f1f02e46cb52311f2690ebc49652eb23c207da13369dc426ad86ff1ddeccf937bebd45106942f13076b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1be5cb87997a6d76272b01ca70572f5
SHA1d1554084d78b31658993bebd2dae0c273294f251
SHA25669619193dc9b4c891802b245d24a2a5da3f1a740d2a32a9d647a516f9c51c96a
SHA512b7bfb37b8616cace7b465b7fd71a5156c4f5c0a40e10cfad8900146aac859ff0bf2ffdec0ae3a74757f2dd9393c2d0c24b697f5fd49ba0345492aa4f2e05bac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fc93c7026e692a4487aa62a35cb4333
SHA1aeb2e9cdc5c4e03d9340084e83ee6be60aa559d4
SHA256b5eab68a349f14064be8c14a0a6c9064effd4d0a98f0ee3951cb349ce8afa7f2
SHA512ca9ac27d274243a716723863fc2a5718b438b6425d8371e79285e5ac6de92b7709df137a255b93875db39b5becffe31f26bfa9f1a8bf2569a00c4f01f026289d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac9dc23182615520e0c523e874dec3b
SHA1932e50d9fb87670bc64fa0f47beece0233675bfc
SHA256268af2003531f117199caee2844ce319a4825834b130ffb69463f2fff389e578
SHA5122b87f6f15ab7c179892a22cead5fdedd78c1104bc2be9d0c71f48c9755cc656613eea625baa819dcc7b7c0dfbb188a393bfed8faed498065c2747afb1222e181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c72bbb21880176274231f8522ae4231
SHA18b22c0678e7e212e09a15a82c2c43aeda980e40c
SHA2560d6765f1eb682f21dd790c85026f935ed2ce4c2b34fe7b34a1882894d6d63655
SHA51216e26f3ab51ebd781e151127d09a2fd6a5644485b933cae9ada0e40356b64ea63cf51da91a2cd4136b4d09ceee405eeb2dded48a85031416f692837d91dd4e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527861da34eaa22e91e76d94cdb019ade
SHA1c51ab12e1c161ff0f3fa06efc4fc8fb5e5b9048b
SHA2561051c3b68296023a33819cbb7d5f2bd5b28e5d9145d39c90801b55e2b73ff8c8
SHA5122705467334a84a83151bd1925594f889b1d682b98e879b67a78a6a4f9cd2c3e6e8123237fa9dc87778caa98a3a2c544a91f92aff191542b745f768c3b723d03a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593da0895dfcd3f4baef7980363d28864
SHA18b1130b97a43ca2550e991f64062e5c713e5a6f9
SHA2564eaf22f608071c2cff6e1e97a9041c057ab7290eedb62deeb043f56aedc3c72b
SHA51293a249a35087604aac1bb7653b1438e55d8aa7f8c14925ae1f71b6639bc6d3899812179ba947476766572a709aa2e4dc44090de28424801d6993b82c8d20890d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d0589d5fb0f0537ac4ee4740bd40190
SHA11bc8b2f46a015b7c3d08a06c571c08249aa9e0c0
SHA2563e30674b33a93813e7dce4cc10935a39ad6a55b0f144e0ca2ee2836a6c2da62e
SHA5128bbfcda67bbed438faeb120d4f2d439f6eb569b0404db819c303bc1a54fb5c0b75698da02aecec3515805df8058083f97ba5bce856af147bc2a6c325db163e99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ce4ab10517a99bb6b7e567d437bb69d4
SHA1a53dce5a725063deaef56052fd5b775b4f57d2fa
SHA2563268b049811b378dd4babcbf1c0d18a927dd6b10b11c23a56b5cf39724151934
SHA512e3f3f5a6c876e0caea6bc16a6e9f2a0b5314793df412aef67db1bc959196b868bff116dcbecc0221c6743fd19ad6537fa7daf7c45401a88e17441e6dfbbc322d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58d3c2e071126e5dbc0c1b838c83e2220
SHA13b630f0001e85e01b983d224930e2d0913ffce52
SHA2568030f83cd23bf11037a6bea9370efa7b7bc28d6da78676fb45276b1731a0ad86
SHA51239ca07a3d314f376797c5ad1cc360958d7229953538bca8597cb164c7ca12fe80dd96dad295b3baf52fdba4e4ba34d9974764460bc234a000ebaac8f6d972e07
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b