Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
1ad864c42b9d73c25c26e0ab09e8bd31_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ad864c42b9d73c25c26e0ab09e8bd31_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1ad864c42b9d73c25c26e0ab09e8bd31_JaffaCakes118.html
-
Size
1KB
-
MD5
1ad864c42b9d73c25c26e0ab09e8bd31
-
SHA1
7f7e46c5f8b360e0fdc8503ca7d25ad3c50907a5
-
SHA256
84e68519712fa51022f3882ada675f759aefd1fd1cc77efe610595f20229a2df
-
SHA512
aebf990c166532a335ed2c777674e36eb3a137d0fcad4903f47db8a0a0eacea5374d92a0cfd6d81a975db40a339c26c174f5147f4edb2f5e74c2b6e3c047cca4
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425989560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099be215841e83945b91604591925570f0000000002000000000010660000000100002000000063e8ba59b699ddece187bf8b79d03787deb6ac22e28d806bd8624abb422e4960000000000e80000000020000200000004b37d958094b049554413cef2f58b0f94ce491c77d0198ba69b4424b8ca9d93420000000d7b9bab6c86b455333f5247ba9229c5cdc9217d9e881ce709e3fa58b22e2620040000000d5810e5912c75509491459bf4d54fd73491b662deeba9ea5d473f732254b1c45388aa288ad1260c1e0e6820a2a6caac11a0e002b78aecbc5d421d4cf2e80d55f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099be215841e83945b91604591925570f0000000002000000000010660000000100002000000064b0f739dcdbd06a6a06bc0471828ab36727270a40584eccad1f39489c5ade01000000000e8000000002000020000000b31b1b70eb3f27d921d1f5476e4202099c5a92b77740d15e02e6577d41fe50ac90000000b595a9dbd20da4442c788b43aa60f0f052b054c15cea14c8ef20c9750b145983b05ba13fcc430d4f0ff72dcbb78cff7791a2b059aaec919f9d2b8c4962500900d72442bd574223a81359fc8c670d5a9be99dfe6241593d205e4ed19284007561ee4c54c16e62474d6ff853708fcef5601ee675c9edfabb246740cf7b84288e854f670d16866e244a9c55cd35f407b8fb4000000056f92ec6a9b739cc1e07ca31bb10c3cb02ccc44d7ad94267c8b6afa2b416896d6773cddf6d0937fbb13e312170e606fb777f11980ba79289d09cd239841b58e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F63F7E71-378F-11EF-B991-7EEA931DE775} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b033d0ca9ccbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ad864c42b9d73c25c26e0ab09e8bd31_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c48dee2c7cf18b6188c0350760046222
SHA1767e3a2fffb771cb596daca5665c20a9e6adde8f
SHA256aaa38b73625ac4cb3ef59d9eb876f834b4b19fdf6102290924e76ab110d3fd17
SHA512ddd84c211732cbe6caf6dd22ab306278f4cb6135848aa98e6515f43b17fdd5302cf188f60e314bb5e81da03147156b330e949564a03694629d1860c13ed27297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d62c301483b58201f9b255bca57462b
SHA1b559815fa3b9656381010d79dcaa964d98fc2a75
SHA256f491cebcccca4d81bea0a26efcbe43c66e1ddac0b0595e45389c5483c530b1e2
SHA512ffb0706e32d33f851cc74daa1d7b5200e0bbdf89c1cfab188680dcfc8e7f23a1c247807d37c1fa6464866772864f95969d41cfd0a5c4fc195ff2f244ddde06c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a8043543590629c0f9f5f67fa1ceeb6
SHA16964d93d15b087f2471b524436b96fbc0688d833
SHA2564fe2a0bbf1f7990d4cae7e1b6d252a241e61faf171988c929c3642adb8be8256
SHA512ceb7e0d921bfdefa9efd805ae485affbe086bd27802a0783195bb48f802639cbbdebc2291e337fb3150d63f56deb38201d88e13936ad4410fa248bf042804fd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e16584bbe470ba47837dc471a9eba8af
SHA118241ccd859798d68bc2867267fa74ce8ca5edab
SHA2569f4c0d23ca661c36e0785b80223c738d75ec18e2743c44368900bd2571ca9279
SHA5123db17f8b67da5d8954defd7cd7fb3786bcbd9c170734da97bd26fdcafe48fd3c438de5089bf936d74b39f60c4f65fda51e4dec42bf00e692d78e887f3ff83feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592f9f56ae3a6081b75bb2cd49aae10a8
SHA1bb6b9d5f3b48477899a5e701251052807ad4c59c
SHA2561bec070b0ee010b0a34b0db1023494dfe7529a58472f3608d021c6fd706c3564
SHA512efcc263eab376b45b39b0970d40135bc81ee8dab1d9e452f33afe16e7160678f1b973908f057d8b1ab2785d38223d4a5b666dea0517ecbe7052e0ab15b35d87b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58494f874622a7925bcc836f04d132d13
SHA15185b6f0a6f72964b7dc0512577590171f29d498
SHA256bd4354af89d1148d043bde744b30a3be16c710051ae2437b0c0026a1eede8b3c
SHA5120bad88817a18262c394110605bac86b43c9c49b1593d36334739f85e8f40720cd274b250a8162561e3049e7950bf10e4d2e53b7c2695881e39f29c020f0a533a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff99656ed178481ef0a76c1cc5866fc7
SHA10cb792ce3209d7c67ac12c41c70c3f7bf0c5bc2b
SHA256b96dea23b50c678b3954365fb5279baa8582f24f22e59f7063ed59080cfad26d
SHA512a973d1bc3410f56a3bf66cc662cdf4243b998185cabe4e6d8e88cf9ef59d2c09a874c9ae7080cd68dec2d2a0aead72f62465d6beb5f7d2b69654d60bac350c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6d5b98937f51a73c52fc8490c7986b8
SHA1790d80a9b56b7d2e4513dc04b569ce56b133d622
SHA2560412a683c9d020b2834f70e74920e66175e2c14ddfa3a147fe3c029afdafb717
SHA5126c5b3c8b9a99b452ba36644ea30592da8f82ba0c662fcb386b6b8e0f835f1186d2303fddf6061be1b5b027190c8241f6798abfa19d0236a41478953daffff308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549b9e5a0764088996337cbb40f35a3e5
SHA1949473b50f0b3db89e40ef54c033cc07da58142f
SHA256c5edfbe3c391c55ac6c5adaa03b5131edbe11838a8d09d712aecaef60966d0fc
SHA5129a0c7c5d75037553449b87c2a95500ba88f63b0448966ea3601d16a1100d93349efb1dab335ddf8385be3fab4f2f4fd74f64aecdd3b486eb208e597fe3fab5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb7b6e8b2863d4929b8f836fd9c366dc
SHA1b93419e5e41cca9b34147dcd97ee80c8a551cb42
SHA25651c6fa874905b42717166233aa5b9d3bf8779ae84c99ebd1375497d53206f7b5
SHA512d19ebcd22654d2f84ca9d349fce502aa85d1630da4ab1e010e7082b41c85b4e9b5cc6be7acb046ad8bc589a47559db3be7cf82a57667415b7d8a59190ce0936b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b4f1471df024238b92f1f7a25a05f76
SHA1d5d68b47e907e614096d71881d5f8cfa8fd52e0d
SHA2562457108fefd2e044b5650b8bf639d61b4314fe830b34c8b62d12853051f65f0d
SHA512573a2dedea977f589ad422a6685fb2091366882a87d67b0e9b83b7adfbf90fd5c8e95273ca2fb64bf3175917bb881a6f8b68cb36235a3e4bad31dcc01120a08c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a7297bef762618b321c8008e30881f2
SHA104d341474c33cbfc6ae87dc1cc3f2c01e71366cf
SHA2562cf1ae22990a0cc85801dd06bb091c682fe268d0b410e4d27f8fedf02f7b5c44
SHA512c527d9fd25c46063b9051b2a1647de16fca5b9e8af48451d22508fdc474974186f6ce938a842ac8fcff2e2d5fa57a5da0686022ae792e6385ff578834c7451e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b7bac5c7ee5c3f9465a09f05681a151
SHA1e4b69391a4917f15597ecf872b3e00c106be53e4
SHA256cbe06fdfeda22d9ee65aabf696db693e44debce119e9bf69f55c6b7de9db1661
SHA512718293f9a3382bc49d5540cd417674bd6515894941751dd3657d3af1864765c4aea0ac44cfb3944e13a97bbfaba6bc6e889bad362d9167bd08736934917e2a33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a5ea3c551e751ca60636e958fad2ab2
SHA1076f04a9c102aaf97db87f91a6f491a40c786989
SHA2566970e80ab0ea4f15640be7ec91802a7c2f36b75dd5ed124f68615a90b23c3a46
SHA5129c08f3ef991bfe8e74b32e4da7c2ce1495ed6ac31a09fac9d7e06ee5a462bf7184649574f7cd1e57ace3c024d7665df587e2f875937bf82bb5d2692abc6c2318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c197126d90b499a7a3314efc44ecc25
SHA12e27244687f91623eeadca854f809c04434d4675
SHA25682a621e65e096668830c348ea0ab0aa779adc0c69bf8983267c102ddd6974fdf
SHA512e6977dd4fb7a8f4bedffc6cb9140d3e499d41e2d811f10c1fb41ef29c6854974448fdd1d64e24a6292ef63b7a7f9fcdae09ac123ff3b24bc4a8a435f9cc23d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e383ab8794433a4d5145ff2e2f577c3
SHA13a5ba4f201d086ebf4db5e9c5f8878680e83bd20
SHA256873d543985544d10cae8085f42b57c1740bf52d1b0a7c628dd6d7c34f8a6b407
SHA512c67c8961ca55eb88318ef6c60f9ba4ad95d4bd50f666eee0639ee01c1fb0c2d519fead88f7108e28e9a36964d804891dd045ac5380664eda639780a15cae09da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4806e47b5aec03a106cd773952538f0
SHA118411391adca495b2deca2e382c731035e327c45
SHA25631695e22e6b4d74d244601c6bfe1d9ffe2bfbebb09ce1e343aae426a5261878d
SHA5121ffc40413133212236d0717679b18fd5163f4d144ea9278ac2b591037d56aeec94a4a95918f6a5c40966e6036e58bfa8dde5d17063536ec9e3e8c79feeab3364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5407b7e3ecf84969695dda9191a46c150
SHA1c0017ea66b5192c9709f24192cff491bf6d060cd
SHA256b814c2ac670d34ebeca4ed050a9eeed2816eaded1d310c1b72374461335ecdb2
SHA5122c273c7121187c69a4552a85400719f7a1a9c26d12ed606f8cb1cc6e737a7cbdeb1760729f5d84fe3d3618c07f86012be557dea60ac699c7992051d89cb259d8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b