Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 12:22
Static task
static1
Behavioral task
behavioral1
Sample
2261afd0510313cc03ba4c6414694028_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2261afd0510313cc03ba4c6414694028_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2261afd0510313cc03ba4c6414694028_JaffaCakes118.html
-
Size
53KB
-
MD5
2261afd0510313cc03ba4c6414694028
-
SHA1
b03ed879346785de23f820879bb61fcac7702a87
-
SHA256
cffe994593c302d3d919c5305b750f3e61707ea2dd2d03749db96b92054d2efc
-
SHA512
ffef0eb2cd7d449cbdfb309f7110f4442223c4e051bd69716e9386ff7ad37d9c50df7e3db9d3560153c7da0cd3823925ce65e838129decdc3c4b9912f1ce33b8
-
SSDEEP
1536:CkgUiIakTqGivi+PyUarunlYR63Nj+q5VyvR0w2AzTICbbLoK/t9M/dNwIUTDmDP:CkgUiIakTqGivi+PyUarunlYR63Nj+qv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000545229cfc73222ffce7b4f50478f586604504fffbeb0c61db1501e107cbbee72000000000e8000000002000020000000d81694be581bbe12e54a60bdb5a5829277c1a6fe378128234d7ff8a6e9ed96fa20000000e9522fcab7403c2a0fc8326339dd343e61949b7d833db2f3a19869fb65e9aebe40000000c96372c37fe8bb3e0b04e5e4bc9157f7fdd545fa51f2f9b15497649e3fd467359cce430132c36eade2f8ec011bf39bb56613306dca8876b0dd6c7c29e4d037b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000010798a70ddec14a6e7585a89c57554ef953aa8b29f33240b49c1ea92778c4b7c000000000e800000000200002000000005ac93f872a9a32dcec793459cb11e5bd8c42d099f755a32253046a21c17a659900000001fad59cb7178505045ffaad4fdec579e68bbae70fed3d6fa66b14061456bf6d9cfcf681f5c4cc21cde5b89648551768af4e96aa148ba6ed4c54796396f8d80d637882e17b66ef968870c153bfaafc925746c9ab6c390cdcb9ca9248d2809cb1782822d8294be6aed312b4db57fd7a521c254f197a165c8012bac5b804eba4329e3ce34ba367021fe8feeff58cb652671400000003b5da50220b1b4a7695c8907a1242edd62f9dde4e3ac2af9cf7c3d021d1a8fb41b722fd48619ec112d15e12456c8ef449dc49ae787f25039d234487008de97ec iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426171222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED42BD71-3936-11EF-B97B-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305b88c243cdda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2184 2188 iexplore.exe 28 PID 2188 wrote to memory of 2184 2188 iexplore.exe 28 PID 2188 wrote to memory of 2184 2188 iexplore.exe 28 PID 2188 wrote to memory of 2184 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2261afd0510313cc03ba4c6414694028_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520ca41dbb192aa12b15ed8e00acf353a
SHA16f8d635f5c817a604afcf41a07db0b350bbe4b0d
SHA25672512f245f290d2944862758d3ce8862e0d2f242bd12d329f01059710b4c7df2
SHA512482401a0b67bce0fc905ebc3be7059187eeabefe3ebf918c1103633c32bfb66ef27728b866d2bb6fa104042961e9af227c616a9ffa14b764306e8f69d9db279a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502904dc28305e5b1a47eb5e97fa54d02
SHA16a5800d8b2a5c27718c5a632353604830221fbd5
SHA256bda847fb62be975e9a50b3b16b5d18ae978da527504fb9137e4d16a2bd95afce
SHA512cb86e12155c7bfefb28bc6defae7b2a0854a9823817479c7091d1f27d117bcdbbe0292c44eaf4b18ff6a91fd547550dbbd3c8d9c1edbb554ea527c4347804237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57019f892937382268a25244e260b4779
SHA1947f5a75f60291cc7c3190a7ecc39dd31b52d2aa
SHA256942638be1628f09890a2846ee5a53f6f757568e1b9d6f9d049bba9e43763b303
SHA512dbbcb79a5d8feeddb856fe2a8b1a68e795c7e31af56af46485e9eca9a4e8bf580443223e16380504bee33e4a2ce32f4dc086b11bbc4bb9211b74d8e3a7e1950d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfe4b50a5e72a3d3ffbf4784d0bbc7f0
SHA1f06f8d47dac069e8abf4eae6bd1811f36b5a6e55
SHA2564916a9b5d2cb9efef59252e4897c12352714d15a918f0ebaeabe2ac724c42e8e
SHA5122c6aa69a9d2b7dbcd79df7fa3eb3f0b43b9e52c931dc40b7917ab87176c4834521d13c670a4ea8d43c0d5cded500d77e49f88ac4861ab3c86cb1bd3a3533f34e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51249a0caae39334c2c67dec0640f2dee
SHA145439616599701b7275f4650d6bda513bd6ba245
SHA256c9988706ec2f4085540861e69c029274cf91c6498a0ed3315c941017368b1af6
SHA5120cd10a933d941b6ec7bc9894774d5aabae71503220181eeaf943612599b5380dd5f61e49387b07e7e90e59080b381ef0e36c0a58127ba71efe44ed4d41bd144a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500dab7b0ebffca3afb25c55b17b902d8
SHA1c663a5a1bf1824c20eca6c095c07caf8c49c1441
SHA256d493420a44844a1ee63ff2499bd7b1e22df2e181ec28e6c9aabf6a603188504b
SHA5125fca75b03840b95265ac6c73f1afcc740f04d2c49463573a751689f59849b16fb9bf31f1eacb9de6c8a9cbfb5a2bbecfc888fda7d57d86b5d8a9f05c5bb7abcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc0e95e11ac1501170e4d0be652f404c
SHA1fb1716dbbd3cbd61648b99fab5a22a5e0327672a
SHA25671d61e9fa131cfbadb75220bb1f41d8f205e4e2d96a5092cd237c30bab7f4192
SHA51276a69810627ec92bd67fe92ee6517fd524fd92e54e9e6ae2ab0b72f1af5bfc4595f7a38876049e07b12f548c55a7ac91b85115fe25380c6725ce41dd86a23d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7138d0be71515797a2fdbed8093690a
SHA1a17a30d4111be97efbbba88d32f1843cd89298ac
SHA256f3376725e8fe2567484412bd2dc7f679e9b8cb95e2ff0ec8333289811315c74f
SHA5127c3eb41664ae889bcd521d27a36b13cb6f50d61263c793c4365fc38a165306505fd08c70cdb76c554682bb1946700c6cbc28c2745c3c00c55202c6039195c54a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511ecd556e42a457cf9955fb912868d67
SHA167fb0f6de143c339df07f9083ef0d3dc94893fb1
SHA256c6e9700f915c3ad8379c1e21bc5d129002ca0cfd10cf6fdd42cc0ffb9ec394b2
SHA51227690fbf682566b64b7153273e36b65d5bbdeda121bf6d03ab37d234e1be09c43adf833f43b79e2c66ef5d0ce4c72b9114923cbd20093edda1f11feeaeac9f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555ca430e0aa403ebc50b50d7657ee4d0
SHA121d9fc99a404caeae5ca79d33f5e93d7e759bbc3
SHA2565837f9306c40102c1e56effd5541df64073a1b62ae49c03173a02b52a80dd5dc
SHA512bd3f66d0cf2dab97db259fe4a4933de7bb1c395c6484096403fa41ce2a89bde75f10152b34b0df3c65c59b94193940707e2181f8264b07294b439daae7d974d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b810aeaaddb887877a14451f69076f6
SHA1715cc98d3582df85891260ed43532a85ced97747
SHA256910b85dbea6b09f6f38796ae830dfeb4c016e21c88ccbfa1e82fb5ff79a99644
SHA512bba15dfced5fda6cc63683b337fe096cb1dad3c46351499000b5df715b4daf7f8e66e308dd6e30ca39c0478a55608747d29f3128a75baaed833898ae755e794b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a823a0dec2b5bc1ce7d48033e69cfd8
SHA13f182466afcc4c66875f61d6b829cab93b9f59ac
SHA25625fde0ea3843a78228b49751b4daf3bc80622427f1b86de76e408725a625ae03
SHA5129796e8603173f7a3a6746ab0ce2c2d4425b4fbe3a8b3c4da4c5fc12b51f05ba0962d0f2c39819fe22f7efc9eb8cc0f27f3de9644c86b26e6cd42067e4eea837f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d2117c8e9a9121f713cfdff77091d47
SHA1213f9103e8a8f6ef83b722a514569c795720bebb
SHA256e0897ee064001993c4a3ad0745346c761839f2179d677de4f98c249f37337703
SHA512cc52e8a16643b9f3cb2564f98e490d06b7b54977f93391ce35e7b9276cb0c902bc196ead33b30c3295b2288f75b81fa1250da08dddac5407d5015d11d7a193dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504da48314fe75a2423e9dcc9d981fc3e
SHA16b14891039a8a1e7a8ca74450cd6234a34478627
SHA2563c14c1c7c158a256a6466fffc28b82c369cc27a1e1b74282a096bea147a4833e
SHA512b4644da8b380e51e19c3956866dbbe52f48ae4dc131ad9c3f6f5b1c846a00978c9cdf89009f3aec9c3bb5047cfc163e82e5391199bc1e5e6b5c7caf93ea22daa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa93a68d3e3b0a29d21ba627a67fef7
SHA1b8cc438b779e1be4fae0599315e679f5dbc885a6
SHA256c11f3b26c77af5baae9bd6b103a69c8d69b551563f16994dbbd4191e4a951704
SHA512a5e2329cf2fb10edad623e3341a677f53ad4b0e2342b9da005766324c105a0c69ef796209e93ef9c292dd6a37936f59cf9e7b832fb8b601a7df12bdfad6179fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0170740a067b5b3b4319aecaa079534
SHA133f817447c6079d7c480e327a1808f12564b8a4a
SHA256fdc1b70a9e7fc5834e69edbd2e2f739f0d0c7fcce6f735cf1f93f858359f5605
SHA512db2daca9ff722802f76d19380aa67f1042e5eb91de02a8a1b0d0ff24a10e64a8de83021ba22ef64b8ed42746de6b1d1a18660a33997b9156c62c3d2a0b7e0b28
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\upshrink[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b