Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
173550f1e9277d51d1aff644dfbd645a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
173550f1e9277d51d1aff644dfbd645a_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
173550f1e9277d51d1aff644dfbd645a_JaffaCakes118.html
-
Size
203B
-
MD5
173550f1e9277d51d1aff644dfbd645a
-
SHA1
e9e0401bc124755a07d2b2a599c2af04e1ebf23f
-
SHA256
99ee7adf35fe20ad44be95290f50373d0de59fa1c37831d3dbe48d74d23a70a0
-
SHA512
a1ae7235594dc64b6a8b10cfbb59a1515590e251d1ef67e50244b118db945ae12104855c61fc2baa0dfef4e4d0a7cc0373cecb7b860d82a7d11af267c2161f1f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c60887c6c8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ecec242aa5b00aa23d656ce103ff1e63610fef29fbececdb2fd1f78deb150aef000000000e8000000002000020000000cd8075327af0388da2c9408e48be5402beb1cb5fb621f4cd3a6da9bcd50f7e73900000001f90905e8d4daf665fffe66cd8b79eb10c0ad01dae990393054bf425096216b7aa6d33b93063b2af61f0a5a33066360cab4739374a08ce939443201794dbfab7d0e7aa62f4c9b3e45de4f03d8773f8609bf383d1166d75f43b569a7c0569ae3fd1d31fdeaf00a3de13939709545b12036ffd2ffcfcf00f9d2e519493c64a62f941bbcbd065223a19bdd4cc5163fd23f040000000d4f979a9011c4afb04b72f0479c0e9707313455740684df12e00c24fc679de89de69fc48d3b06a4a92389c4f133be035c62a008024e445d469607549a8c4f3c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425677656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1963701-34B9-11EF-9486-4AD8236FB259} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c33db3b2507f723ca907849cd2ec8bd8dfcf59148260cd69249c5b1ba25010cc000000000e8000000002000020000000fa9789d8eb0c7bf9cd087fd762e9e214e80b8a31ab9017c26e1bfe9292fbd83b20000000cf0be45883966a93d1c9b4b27fa4663d84bcb6dbd67685284d0868521d14a9304000000088d98a713630cb8022cc4448852561e3034f4a5883e00761570a5e3c2877d83544ef79abbb6048839f355d17a85e7bd0a0cf45aa9997ed25ce327126a7d2aeb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1732 2208 iexplore.exe 28 PID 2208 wrote to memory of 1732 2208 iexplore.exe 28 PID 2208 wrote to memory of 1732 2208 iexplore.exe 28 PID 2208 wrote to memory of 1732 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\173550f1e9277d51d1aff644dfbd645a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59cd2f67df8d1196a1c998cd9c85ce8df
SHA194e558b6af678dd3973ce51b018bb857d7bf6f05
SHA2560d617e98cf2945510adca0e198ad8789cb0fc6d21161a3f00614fd3e2b5878b5
SHA51270eef263d7f5696fc86d963a14bc13bf86ae79c39ed4de95c0eeed1466fa7347c055cd3636b02c2c359ef0f181a68e5a9747d05ed38e8cd61a82c024a7c0b2cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5377312cac17e803d124b2c9e409f3588
SHA17172bbcb87eb8d4a35c693b6d139e54fef38f4d6
SHA2560e380020b8607adce67fdf439ac82e4b4e735c92eeb336ad7ace26d3955191ea
SHA512c30da84ad9ac5cd4bba7ba7f266d555be8391f39e8fe638650731f3926eced47b71208ee0931411f005dd24bfc6539476a2495250bd03462e1b32c55bc40306a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5929ef2c11b8db5433b601c586593269d
SHA1496f02987301a1ba559e724d663b1fefc06f4ba0
SHA256e2435ef7f1f8f4d23f582e62750544dc484b0c0651c827e6fc5b8c2e8c93da8e
SHA512b541f0227e669bdfe4900b3bf3f98f8266b1f9a710f9274ce75a2d01e77e294b130deb580ddbab31f7578fef4a61de3800c28b515df4dcc943e0c2192849bfe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ba294b9b2efb4ccbfe4be56c359f3c6
SHA10693db3896bab10ce58851d0dd70a14362f3ebe1
SHA25647b133261bf19771acc87065c544d579012ed78062a002f54c69efa57155d228
SHA512592962dc4bbabf36f1d625ddeccfbe2b2e0e4a506ec543f54b7891ec24cc4b78143d99ca1fafd4fb1b89541fc15b946b91eb81038f25b06ecc30b0f19e7cc407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e97e9fbf4ee5430eece5ccaaf186114e
SHA117d6c5ef1092f6a5a3d6c87027f933c6c7e911f1
SHA256c7f2da7437bb98e04a509c222fbfacd0719952556ca840365a20c078a98d1cfc
SHA5127560935fa90c484a0dae0d5d751b5059ce0b9c2aa84b9b166a53c60aa4320532aa4736b96ee75ff08fa0f45241fa101156f5e5fcb2e23899bf4c7028fc0acb41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ebb0c3c217e9d79e0e6f4a38688a1a5f
SHA1111550ab0cdec60f99fca15c2d74c37428fa1f6b
SHA2563ab38af284007ac549d4f6233eb5d48fb6b155f2d921f2fff9105c8ebf43d732
SHA512875b1de24d2fd64bf2d8c1a881c0a40922ecebaa49400dbea90e8e41405ced02b3bb17966cdc9591e918d11c97fcd9bd2dec7fe600a12c99f25b0c6e6108ecb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54bb0866e6631c20eb97cd01ad69876b6
SHA15b8e624452798393a439ce1330f5ef1b881cd4e7
SHA2568a1f64f5599e4a86093ede81c02b79fd2a969b52773064cc9ad99b595cf67f6c
SHA5120b604e5d924fc038fa326b6c1527d6f324e661a360acf7e88fcd870893e72ae2210900d06fa995d8b6bcc1456286b054a0198cabdead009c00c6b6baafb4be20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD535998967edb7e19f6fad1eb5ab82edf6
SHA1cb96bc549e006b3b1e5e54fd5d8f349ecef51fd3
SHA256f76d79f2cfe3ef64934364b1adb91551efcd4d974fbd1eff2e5f5b872a8b3516
SHA512a68ed91b92bebf07aa1e4945ef01ed08e86b85d8194bc1c66b6b6f81f7fd52ade0f54e545687cacb4a4602ad05ec6474cc5e53db72ccadc0f701e1f3e1b0f70f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bdbd12660ab366372a7218a95c6bcd4e
SHA1dd72892addc889457fed662a607005309d0de028
SHA25692cfd49f55b0620a6d42c93406e5e1e70744ce8cb89fc32b22ff81e31da4ce84
SHA5124fd5a9daa0ac4e7c341436ef61348ce8303a39fa7d7ce34e15c1f5160b16bfdf68acf01a3677fd394eaf5ccd86d590bd0849a4520b596fc417fdad1417651d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD583a01d8bcd620a09230bd372ec0f135e
SHA1cf1c58e0a85d78ebe7e72cddde2d8e88c9b42a9b
SHA2566323de835b22ed4d01febc5452d2cc0928a870d2b8d6a4a31bc879ef568366ab
SHA512dc68878da0bf9e7e780db6a7cb2570a2a9cd3c99c67a1a0322e62b1a43ae5a9f8b108b580297b4c71f189f7ca53dd95d3b5fe19513ed2b38429bd7f5ae1d66b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58eb99bb6e109d3d07f88d49c9c6fced8
SHA1f6c8fd46f94fc63cf1a214220e69cc9680f03299
SHA2565b96677fdd940b23d28cf9714853cb20d81388b3fc153f3c4a501ee09b43df2a
SHA512626ec6bcbc3c454c21e4634d6e770deedecfd4790ee3946f84bbbeda7bb65e2afc98df8a3db90f33857d28ae9380b4dda462333c33d1a2369cfa7fed9ab9dd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cc379c0c8cd97ba57534ef94d7a9fa89
SHA1b07cb8884ee534d2c2bf68ed9716ea30f65e7311
SHA2561baff780aea7bc69c934d727a628ce3c07a1682827b8cab14824479140101a5c
SHA51235f690219604d8cbf29710c3466cfffbf3d7dbdede643d5fc56c11127d4f978ac27f4691ef77c415aaf67107567da99462c0f3fe68c5d19abc73e45ac97cfbad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD550a983933fd519d6c9f3e2cf49ff02f4
SHA19189e8b7fb0eb3e605d31e607b2a578e356c384b
SHA256c5fce01846c54fa42b488aa498b01dbc3ca7a708f28f8425a587977092fd415b
SHA5123deef0e1e9b7ae9993d39814c8f387a750c4aadcb648feaba38efb352d97acc96ceda967ff2d8ac2b1ea412c6c879370ecacb5122e04f3651b62c202b450d1d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c32a920f4f728c48e32de035126dabf6
SHA195d67d01d58d0d0403a694f1792e7ce7133300fa
SHA25681866b6c5a74794e10da39f5b47f0600c7e5fb73d6911c60543ac6ce5815ae4a
SHA5123895dcd154f31ae0f8f261829fe7ebd9a3d135e9e75c486dafa7975a29a68ffb1b6eb6dd3f24831310598d4bb9a457ccfe199fcb6c98e728352e11ebd2ec83f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eb0952a95095412899f1bce9f596e8b1
SHA125f2a3d11b380bdbb1aaff3a6b2549b65010ebc1
SHA256bb9bc2f288a9e6a3eb7e064cf103db0e43b56b30d8a0a037c0be81a542e0af4d
SHA5122f8a677614c64613f08924d9b4213445bed2704474b89a4ba2ad0d79adaa5b5b9f776ab9c40aa9f3e72461cc9e7b6748035a186b298370975097105edfd54729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD556a850aad643e26dedb22a03c1220d3d
SHA1586d3e96b9872ea3e68b76ab3b1690a0edb7a405
SHA2564d9c2753366f5cb919f4a3073821c2384f130afa8db5a7cd076c56987f8f6aff
SHA512cdd9c544e7c86edafa400a11f64c50a29fe6ac14249750060dba3c7d4bd8e62f25489924445dbf1dad3ef7909706bc1e05ee43dc0fc27cfceeb6008d004f7b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5937750e5477b8cde0cbd264c0ac2886b
SHA12716db7313eebac3ef935aa6c759f7bc7ce9456c
SHA25622e98bbbe6d79e099d9638aa975e82e993da502d4af799a4c4644232d0b6bb0f
SHA5129f438586d40411a68807ca354b1907a35a97d93d9ec7dfd59941f798c3868dd771713ec6046a8f06148a6452625116893b83e0d5414b8edb190a65589ee61228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58f71c562a48ee8e813032f292749d3f5
SHA1c2136527c113df815142c62fe198c0fba11324bb
SHA25675474396b89584fb17211d5a4a167a9b04b67af0da0ec1f89350f9ecfa220a53
SHA5128f427e70c7881dfffd42a5f77a16f6d76af6aaa9e23cea50f9836f97d9b59daf84837b323ea31dc5bf209d19663572661e974c63bf6af80846775b43af356b5a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b