Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
0882deb785a48243e7d1cc2c19ab6fa8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0882deb785a48243e7d1cc2c19ab6fa8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0882deb785a48243e7d1cc2c19ab6fa8_JaffaCakes118.html
-
Size
222B
-
MD5
0882deb785a48243e7d1cc2c19ab6fa8
-
SHA1
4038e5175189d5e36ddbe487931da463bc96c612
-
SHA256
5a3feffcb28a32e85ee16312ee617da129b242c0a189ca58c84069e068ba5d9d
-
SHA512
d766e1d7f08fdc15e00d14e735b8a02a50ca7bf4359cf4433c9a00001b466bc3783f7702cc2b31102d49a9e6b935042f91aaa75b3865d12718526f3b6a4f870a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c71a4dbe872243815f6d5ea244259a000000000200000000001066000000010000200000005152425f494235284c27a273b16301f906b9254f8b32cedf936d285fa8444708000000000e8000000002000020000000aea1b8eedd87240eb4d0f0d86a80541c2e3f1098db96cd34aa91c92be3c41c1820000000ff8658cbfe02af4ef72ab5adca0ae9842d5a849b0effd2f52532fa21ee11216240000000ea4e01f4fee6bddcf8ffafa41bae67a512d764ac88e2c7f0ffbf5c9a30a8ccb27856e43229102973272581be1995bc20c59b9ff09e3c2bd10f292902951faa8f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60F098F1-3225-11EF-A8CB-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301d9e3532c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425394027" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c71a4dbe872243815f6d5ea244259a0000000002000000000010660000000100002000000046a61bc8f356be4a942a446ac80cee217d13090895dde5de93d04b9c3987247c000000000e8000000002000020000000d47de5728471b5acff60058b2eeb9e657d1953fd1403161a01ad3517dd0c3d46900000002c7719b2bb324823de1c8890b9a6987d213aa69520172aad6372f3de9d6a7fe33dd1ad9218800a2a593861fe4efb368c99e1568edd1c06448dbef781a8652d0be26a0453bd396c37dfa94c62d8f8c27c5be8c70e249ee39e2ef036b4d27fab1ba7333a0be6644e409ae1b91e88691a6034b63bedde5153365ce9c8c1205fe89414850fa1d8bc9da40cdad3f062fbf8004000000084cc31029b76ae7f5f40a9c719ae6c191c8f885ec125d59ad2e6bf3993559602c28ed3e232db389a4b7e6b388c7ec9b3df097da58359e4dbc19cda907c912601 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2344 iexplore.exe 2344 iexplore.exe 1160 IEXPLORE.EXE 1160 IEXPLORE.EXE 1160 IEXPLORE.EXE 1160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1160 2344 iexplore.exe 28 PID 2344 wrote to memory of 1160 2344 iexplore.exe 28 PID 2344 wrote to memory of 1160 2344 iexplore.exe 28 PID 2344 wrote to memory of 1160 2344 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0882deb785a48243e7d1cc2c19ab6fa8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5454589d7ec61d28e6df603948efd88ad
SHA1aab3298201880db258b77defdcc8e839a85d5a0a
SHA256e03b1b2e357aaab91290a76912e46b183e0f18c11cb6c7bfc80dbf839b418db1
SHA5128968ff49a287b1c00b69c77070f4fd4b046a80c863383ef5b9c27130aa398aa1f57b7a347fa9a3b30b6c19d0b34eb33703bca71bc30c84f761707fe8c883e715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5847223719a33ebaf6f22d5f80071f1ab
SHA16c386620eaf08f92889b7fbf047540b454af3643
SHA256eb4bc613915d393f6158724d89dfda4db39a40f062d07878b85fa8a269b86867
SHA512567da4990a10afd7b6e026ba8ef19cac49b9336f2d5a9557ee9243f62dae9f821104dd372fadd25f6c5b5feddae927b87cf8ad20a0722e35d0219a3b7d9e4c65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f1424e4bc575d8c40ed96b3cab21331
SHA10947b4776dd5e2cef39fda1f0bf07d6123865373
SHA256f4268b881d5c0c5d007eb77cac4923ae1c55f9e4ef20e144a1096664e9bbf202
SHA5120136bd797b50a614f2fc7ae00d355ca22ef525d035d1a3c65c62ae723fc9c7354b155f38c595ba7919a743121cd42a209d71b122e586859eb7b4be5ae28749d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e3dd9047acb4dd0d833c8d03140161f
SHA16228a81874df3cea9d05a3220e0a09ef2b9e12c2
SHA2568388196bc2da42f341f982ae66f6ae1e0289d6a6ecb7bdba5551678fe8c08bbf
SHA512674005e9a3af12014da1dc3aae008ef429063b8e3c3d6e22b959ee2f3ddc801deae02957ef05b28bf56db04a049d216b21b3c762919ed876b7372ee5804ab29e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595574ad1ae301db45f0867ccd3c0d083
SHA14453a984a35e7ea849fa7553723cd4b828837586
SHA256460dab23f1a6ce9f422195f05629427095fd3e1edbc3d2914797105462917a82
SHA512082d433163d143a718e3fce77a326484cc6a78bc9e74dac7331d6a1e07d096b5da7e35545c76a3ea99c9c5483412e0a146620a02a761f370f1b460d5a3a2182c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586ef58248b1d1d6ce7cf0f4080f1ac69
SHA1218073274b27eb49c5239dabe781b44f5c320624
SHA2561c069a422525219f50a44703974e327a612e5ea20c0b1c209ec46cebb45a0d73
SHA512c350cb31ee800bcaed0115abe5ef33b3526d7ba66f7e0fd2da29e7162de653326972d6116959ad5b0ddc932b278c41020e229a8d18eee3b3a3a2fb7ca73f06e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5456aa15cb445f7c13e080744d2d207da
SHA12c04b5b7e563368a307d40a1f29a6d33e81fdd97
SHA2565957518ec4ff28e39215eff70ba715425e31e3ee6ee34305d622dd729762f794
SHA512091aca7551ab231e3b2c7bb2caee87bf518ab6d194a142d262812b3adc74d7399b8edafbb8b7fc451d6b57e802dbfbd19da2627dd763fd470d3c15401c7c9763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad58971c943953bd408ac07a7825df5
SHA14c360a816b65b9061293ce9de2caf2b33eafa021
SHA2563c4cd873716c03bab79ccadec37e87ed3602b5761895d1e924182a5e86dceb54
SHA5125afd04f01b2dccf3c5ecb3da60abf4f7e7d2b96841d7636acbce9d3857a88cda07f1d262a6de0ff953a06fbee12c18aa50d332da7f6bfd82348c4422350717f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9a13359f5ed401384fcf28477e057cc
SHA19bb7459faa085d595d2b83264fa7ba28a69338c8
SHA25675e8d92f83f822386d715bc1e152b2c457aa4076f627d71777703776303a5c8a
SHA512501cbd58583f61599b0d6cd9b477f651acf1112ed07b150c7088f103416736876b0506a0318b65faa617b73e23ea6b126170b929f2ddfc6972a867adb041a156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56684b5c3d3caa858b6e048b3fb303092
SHA1aa0a9fdeba9d540d42332194ad4cc23b5b836613
SHA25600a12272577270105ee0a884a2b5bcf9527d1c51d753f186e66c5716a7dfa58f
SHA512e6c0a8fc78ad36459176b850f2f81d50a8408c5c0109cbc0515c49c3f36933e3a3e455dcaf44a3f08bb30be45c989a683dc4d8f3e44eae6c386664583cd14352
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5839fec88eb8530786b38eb774ff7c601
SHA1d3b8105e6d7420a3a3096f10e0000abfd51e183d
SHA256d5c89ed6bb2405f8e9082de4ed03464156fc0bbadddec304d925fbd75c8cd1f7
SHA5121595920420d5da1f5cd25b001bb068f393d251aae3633e0fef2b6617e3755a6544765c729bf8a3a938d3487f8bd897b43d736545ec5209b4d8b526a22bc6ec81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aefb657080cb233960a2daf97bd788e7
SHA1ba52cf31cf68ee418fb480548aa742148d6a1138
SHA256e9be4e11e7334fa20141dc32543d97e1b3a7e12a4ade63de85622cd60da0a590
SHA512780604ede13789ebda6f0ee231c7a1c1514f58b1ac8b8808273bb1b2ad1462a23ed741e39142839ccf9002755e793054b0e18b60038d1ebcf923746df1374a5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5733c5d898c193c28eac6ece17330128d
SHA17d34c63674976d84fa0dbada0c7ea02b1a730bdb
SHA256139f6d3d5b047a903a0f8e6749808d8131534baf0619baba17aec60921b79bda
SHA512bd3bf78f5edf35c340dccef842d30b79153b1d4e8f12f31a411e98ac327e3ac943e8f478ea9c36df5e8193e7efe0bda583b3d8c8093eeab9f824ac83eb48fa63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a21dd1b0d5e3a2c75dd08b4679e23f80
SHA14bcc5b92489b967ee3dd6d5c250e296a966023ad
SHA25605145a1032c23104108be82573b8f4abbfabed42674b4eaafd7c3603ebf41d9d
SHA512519c45821a67b2fc60ea8e715a336f2594b6d88160710340764ed7c140367387e219f8accef0339e21e947da03b0305b3eaf033bd5571c08fb4db211cfaadad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c200d618fa4676649f7ad926bb2bd465
SHA19ee6527742cf144641d76096e8f3bd45dbafcb63
SHA25637b76c8758c0e6d7c5afa9bd319ee87feebca7a152254de1a8c8f7c7f00575f8
SHA512e6fc9a2bf3778fcc03c2fec1567d191169ec8738c27d8cccb86b21d12c7e31b3ebb1786a7e2d4ef373e14fa28d69c800558d54d52aecaef6bc50a3ab911eca27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5a9a2982fdedfaa6a02206480704084
SHA1eaec3ec92c1f994dc1c847c8ce7be4609cc7439a
SHA256769722c83f5f99b595285fe3d839684f0a81d4d98d2387a9797eff7de70484c1
SHA51240316329308cefcb1a14bc5d923565240dc2c6fff7e4a5786431826a5224430a5828d008ef2814e065eb21e37c5aaa0e41313fec7f33abbb08ce2f8f31ecaaff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b6d937b5b3611a045824d899e5f6f41
SHA15239c6e9dad14b03097f4e23cadbc33e904e5867
SHA25687dd635fdc523f5141e6e16c3f61e4319c05a6f26b35964e00134b70280494a5
SHA512b1308abf322166620b5909303eb08eb85534029b2bf86379ffda125931400cdce81b3383f09b9673ca72863c9ad306c09d34cd9f5b803b5bb90f82b660b9610d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a65a0707f8696ad875094cfb69e7bf3d
SHA1198797600ed54954c55ce2ce6ee61c208ec9e169
SHA256d5b837b10ce9efc8e71de59d0e7c3732dc9881709f396e476f6069ce18dbf71b
SHA5124ab598f58fbfb84983a79a4b7fde000622846084608a88a2ba75ed58a80c95de25cf979cffc78eec6458d11cf3b3a90e031a54073342bea09e5382805998ab6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526dbf038a6cd87b872269a2e38dffa22
SHA158dda352e77d5989d8c78cc5ecf65185d6214b32
SHA25607b2f6578f07ea9427e43a0b820e131b9ecad9a9caeb364bd9afd2c5d7def7fa
SHA512a4b300958ac9ccf53ad11c07cd44458d911f5bfc1affabb3635e27833e6497b1e5b9bf5e05ef28f4bb31644f7d3c588d9e09df5260323dd12cb9498cee9bf913
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b