Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/06/2024, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
101b9a659d1105e893b389477a69fd10_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
101b9a659d1105e893b389477a69fd10_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
101b9a659d1105e893b389477a69fd10_JaffaCakes118.html
-
Size
10KB
-
MD5
101b9a659d1105e893b389477a69fd10
-
SHA1
56835374d1a899d028bf231978c41065cf85b854
-
SHA256
42636861f11e307f20cc2d14958278996a84c86fb7633076fe687be74ce53f41
-
SHA512
4739e29e185879a2bc00286d1aedb8957b7b2955b2a14ea1c8fce657456a5acb4041e06b0aaf185763a0739482b3aed0b448738ffb89ee98c110242af01f5a1b
-
SSDEEP
192:db6+bJ+zIvDVjc1wALMeDsAPUA214u34wgW9546qHzDEQyg:db6+NQIbNChcA21l34Ry56Zyg
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FABE62D1-3353-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba5516a197a0d468f6bcc03cc7a6e3f000000000200000000001066000000010000200000007bcca3d2d6bf1ae268f15f0d3471311d15d161dc63f6feaa749c61f53e8b303d000000000e8000000002000020000000f638e6a201e4766d35ffd3ace87969047bf251fc8ddafafbf5722334f40aec02900000007595b0ae2ca3886befb6de62a4a37e468b9eb7f96895ca2b70b2386a660b68b01500aa19ef18a6844817bf97c0ad060537568da853a9e5efc97e66a27bd4bca4e27807390aba6a5651958fb7c0f36475e4b04602fb57c4c56c3abc0e631768d1233ae64e94fc0a095d7dfb4e17ade78afe1371b546ffc663dea440d04887723c979859c8cc339ae28a2c70fb61dbfce3400000008a0a465e8688fdd7f03685857ed66d2587cf8221cd4f05058eac442e7738d7608e45791905bd5cc16b169c7763128f9783b32b35e472906234a60ade8cdbd488 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fa6dcf60c7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425523993" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba5516a197a0d468f6bcc03cc7a6e3f000000000200000000001066000000010000200000002aa286a0078014c59990fc4f597c782a8975019fba9fd57bc84689b74630590d000000000e800000000200002000000031775c682e1fcb824e1c3d29133ca7179268788b2e137de47ce682c70ee2090920000000f39f3dce916f6f28c63c75c6ac22778f39d6a8c4081c0c722b0dfe08e3fbe38e4000000006f2ccc4be3134b9c424c67efb42c4191a00487f8ea7b23cea296ff60210e719ef3e0fe9c74d4cc6e4cc969fc7129444a73c99d7b5747234c0b5a88525e1658c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2612 2188 iexplore.exe 28 PID 2188 wrote to memory of 2612 2188 iexplore.exe 28 PID 2188 wrote to memory of 2612 2188 iexplore.exe 28 PID 2188 wrote to memory of 2612 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\101b9a659d1105e893b389477a69fd10_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501c1f776334120934e4452c47286eb57
SHA1616ade86adcd1e71812642a5c2e411ea2256ec68
SHA25621eb30c8cf8f8f5f4087f5c8b398ad7ac43d08a831d530a210d7497905dd5e53
SHA5126c943f31e13a33bed3b4e0868060fad881c33e0a3b4cb146485b78d131f61bef836494a6f90507d4c2233d12875716ad326fd857e792e0d8172c3f70e361935b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58907edf13e4333f2b725597e1d5e10ca
SHA1ea4d1dc450e24abcfdaeac6931ae8ad2585a86bb
SHA25635f3ac91ddb0f893961be2a55441c78430f6d12a890f27839b3eaf972ef44114
SHA512f4e417917b8776017f2ddd4e28824260d42295fc60f3289866b7562074b13ffe39d398f70ee9da23c5b52e67b753585d50e89a4e797b3c6cbb93d5ce3db215bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4e51bfc065a056e34f8b87257d2ad78
SHA130493b8c252d994db58052b2ad8e4be4e2ec05d9
SHA2563389eaa33f64265ec391010c082995427c11877df4c426611e7c387aa3f1652c
SHA512d47b30a968372acd904be026dce7e50c323d1c2bf62cb6ee811f20a1585b8502e072be3392605e90275ca5a1918705c6cb2d77160fe0bec83f0d7ada8531fa10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6c653a38dadcc5b51462c79eef62352
SHA12c369945b28e58ab864e8b9e77bdd2badc10221c
SHA2562b3b0403e7c762e34615d94fa9067e61934d2f73742d9f9ffca2f6973d711976
SHA512bc18895243efed8a9301187d07a588c4d17ed6d4641c1095aaa5cea5a1eb97529ef57b85c024276df634dfbde45792cbf553821bfe9339f8633eefd3ff83178c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561e75f36fece02093c30f843ddf5292f
SHA1d0a70a31823ef69f484a9e529ed8c0f31c93e028
SHA256c7c47aed43212fda2fbe78d1ca6f80effee637435a94900baff753bba9533ba9
SHA512c0944d46ef971d8b6b3193e8ef02c8cee07453ac49493e7e4ac666f8942664b1c7505e8d1a272ecb248d33cc9cd94f91eb9937640afd08765cee9d51c20c722b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516bb80bc17401670abc12f876e8f41f7
SHA14762e392921d3b9bb28b3a463849f68dade4343f
SHA2560db9a60ad4560824d35726be1d4af2ea31ddd7bff5cfb5f6dd52a8dda7c5bd20
SHA5125035237843dadf9f868beddfba40a04616384e99c1a9aae238bee4ab9fdc6a106c4d30f3c5db3523d8fe24c28d87e26ca8b707de40f8ce8f88a9c6d256595033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dde1f76d06d80f7a763d99c042dd80f0
SHA1f5b3bbed87f42abc1f489a2971e5d3d384a20e7a
SHA256a93ed1c1681194e537db6d99f564a680cb60ba8b37c3e912c77f39cc1636c8dd
SHA512c718933520d763ead15efe1680c2e15f05df24be869245264dbbf0f8111f18da58b4f24b1a8654a0829f002a34181fd7fb733a39a90f0e77ba838a3d4b54cb56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5549fed9523db43a1aae8349469b34a21
SHA15d2f62ebb830cee47f240c40cca079a064996747
SHA256be122b31c69989c9893c4997d45d9a565c600e7fb7e8232f0803740c2decb600
SHA512d816ed983803b5665f14ac0ebfdce62be776048a6b1b48e5fd442fd242b8271a91ffcd7457698c30d2a7231c52843b27bf0b0dbff65963863f5587c5d6e8f115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfd60365fe1790bfa41e883a4a083e8f
SHA15087f5a52a37f849f965fe0d0123f95f2a5b9cd9
SHA2566b024dbea307cda092b310bec1a8cb01266c710e52be532a0456f0241197d502
SHA5128f4210c652c58c8d683c3ca2e7af783eb294766791c83b70037dff884294d6c1582848ae7bec3952de95f5566cadec2080bb413d3db4f31e6f802f906be144a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ff3e3a4adb6970ae2c0d6c6564399f6
SHA1f4828bb98c1a351838324b88daaa7e563b6e867e
SHA2564f7d2d8f1f729141ae24acc278e03277d92bf437671db0cb41464f1cb67a66db
SHA5124bbac959b3e5536a3b57a0643dc4d1d38fe6c513fea389475ecf0cd22eddaa95d6c45323e32489813a503a5bcd0bdb38f8876ea79cd751e6fc1812a000b77530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510ba84e5fa316c7e7f7d73f45b23f4fb
SHA155ae7f214d60a8c755665351bd9cb0d34335dca4
SHA256f42977e67f3f3e061957f791e4e8c508d695e0c1e34bdd2d9ae88e3acd799115
SHA512e15d1db0a0bb61c6af48f991811f8a9d8216b220e8fe5e9a262c8f4ca05aeec1741c06ffe794c708feb989a4d9b045d11fe93df0f4081e0ea9b4b6df2b118ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5425ff41daa88ebef0e1e03b75e249a07
SHA167c659e12121bcf8c32c2276e56e612d5fc226d4
SHA256a6a3a79c1ac38c1681c153352ea41984ae21bf553e69d40514d1fb57a2692f4d
SHA5128f4baad9a06014d52c0a171bb6aec480f240f3c2066a23bb42ee452d886e594369e51dd45b4be76261628f7c75f75127992eb22ce71cf0312e750e768f60ec5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5161aa6f426303026e707894a86adbcf3
SHA1a5c94d0bef2c205712b487a684473585e464ee42
SHA25677ffc08a3c8110352efe58d6671b50074f3d81350320d576ce9fece79ce34ffb
SHA512a6a26b2ac371b0334973dd010e30297f127ba591fe36359097c69fde23ceaaff2b884a5e04ade7e31c3255e51255fa0924422ac54903613e40a8d8ffa262a8c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d057cd9b9b85fc3d59b74e2e72b4989
SHA175ebf295244fe380ada8231df3cc0c6207e183f3
SHA256efebfac344f94f8b26f100a5d965e03c71ce5d099046f8a6dfef4eed60fb5655
SHA512a29cae162728daeee57024f5c72742b595aa862f3fd168fc51a1ffc35d6b65f6ff1562ecb06a4fd536d2fe82883c1a01d12f77e2faadbeb638b3f393cddfbbb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5167df3b6648f67592461c00311fb22dd
SHA1b0955782f189c35a1580ae65bab2eb86338c50ec
SHA25651b1b1c0a5ec395d65b1c661014951223165c8b29c3883925dcd05983e918aa8
SHA51245ac980b95a2a79a147cae1bc26d090c3032cf163dd67a301a1f51bd3f1eb0f8d2346381b0df03540414bb8a7c00a89cd1d96077d7ad110ec2eb098163d1d488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552985799f3c107047b74fdcef6470289
SHA1105284a792d7256676ce98a8494154ef1a7e42f1
SHA2565cf1ba71f683e498203fd09f033a93d2d718f1f7d7093af7662d2f08adae048b
SHA51239e675ebd14e72444eb830757502483044399ac2c1b46189583a8becc570ab53375c98165abeb93852528cc4fab436504e0973aedbf35a3b6cb4d90e255b11d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6fe01fc5b7839f3eebb0ff8223f7171
SHA16e2d0816448959f0b5d4612c902625be7dc1e675
SHA2562d5643509ac38131c211194e87a671cf0319f2083fe3a4161bad40f722265693
SHA512391a8f32880066de913a785415973062855ed44a7e76923d244156177b637e892cc4874e2cd843a5c900e8b79854211a9e934f130e253991416e703b59110de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad412acd9968c38932b5c1c4aa2962f
SHA15e43ffc570cbf9202ebf122301421799bed84f60
SHA256b54608c2c58a011277c09e40d1a0c18308a3f682be0cad300718794a35b7a654
SHA512be1ac5c4449ac2f199cd872a52dd8c7c73c9ea6874ad374754c47abb57d2de6f1d8ece3ed21aef728c75b6d8bb40b08c3533c282743f9afcec64a0568652657c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583c727c71795dfaa6d19636f6ae5f0a9
SHA12a6078ccadc2cae2608454db01b32d0fee86365f
SHA25669db003ac82e23286731ec3ad2d3323c2162359aa8f8a1c0df24f0f621ee16ec
SHA51204469d108a4f9e69059a3438f794f8a1ee18884987f838c02d89f534450e66c349fa61f97e682fe8280516a62c327f3decf23791bdb8afd2d24f0960daf7f986
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b