Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
318333581f0c72afc693c06a86144ab8_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
318333581f0c72afc693c06a86144ab8_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
318333581f0c72afc693c06a86144ab8_JaffaCakes118.html
-
Size
5KB
-
MD5
318333581f0c72afc693c06a86144ab8
-
SHA1
ab218437b316bba468a8dc9365b94b4e8614f274
-
SHA256
58debd903dda245cfd40a3024fb265dfc30956b4b46255b283951d04a8d417a8
-
SHA512
ea8f273f3a2561caca329b6082dc714f7bf65ce97ad2db2cc7b675557444eb9a25f40e7f0d7f486929763931175010515a25e861f25eeca7db53c65a8e4b5a73
-
SSDEEP
96:uzVs+ux7AjLLY1k9o84d12ef7CSTUkzZ7ru7f:csz7AjAYS/j76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43BD54A1-3E2B-11EF-9CB8-C278C12D1CB0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000001874454e72941f056b907a1ca1d119785fdf6c7561969a4bb92ac3d4f0c5824d000000000e800000000200002000000034e7f8a6102509260128a08c13909048b4e3465e0fb3afe32b14e56b480c44bb90000000446c327f402bc5a9ea1a48bb29a823f1c0ae3069cfac73e21e75e6385cc78c41884f9ef78ebdd1fc22c6455c38af75ab95bdd11309e4eadc4911ca622f18f444278b33835884676f9dc0b557ce3cee6fe573915448a4d7a073397da521355c177a9a1abc3a0b59cd03447a157a15b6fb1cc8004249a37866f84ff024604077f3d53ebf92493215737bd5a4166031ebb04000000008bc97407730e89431d02333dd19707aaf986753011dcf67896e830124126893f606a0d3943344146336e445f3c0d6a00b1c2512eb45104342cf477d303f5b04 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000091b9ebd19f2f0710a7658e9ed1cb3e45893062e21e70fa5a65671f93975297bd000000000e800000000200002000000005dcb3a5f89118c33ced482187d8ae93521598869a30abb04091a53522c9e8b520000000af6c1008e61c93185dc9f7c0a82a11d60932e3e4170812ecbc08187f959a86e740000000e4f42b9faae6d42c6af623b35828fe2a2caa30cdf20dea84da135796cd41dd6ff4aa65fb7a956481c9e7eb28816383cd53c5403793e4a1a774b5674bef46cc6b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a090501a38d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426715969" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2128 iexplore.exe 2128 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2284 2128 iexplore.exe 30 PID 2128 wrote to memory of 2284 2128 iexplore.exe 30 PID 2128 wrote to memory of 2284 2128 iexplore.exe 30 PID 2128 wrote to memory of 2284 2128 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\318333581f0c72afc693c06a86144ab8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57e945964cbb082f5dc1c5e091f9cc245
SHA13aa417905b9b4234e3510d74c54c480d29e89e42
SHA2569207b37a11786d019b6e0ce25a6f387f87dcc2e99f1c28573db11218940a021d
SHA5127df540d25ab14379bb08d77f38f23fd91999718d9ae2a4d6711612069b0ed881ae898be286d3c0adc24343f71cdc963cf7f50c6c5c249fc7271abb40ef34d280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55420fd39dbf417637d2fcb7a48cba151
SHA1ef34064bc727c5f2774a26e8f9eab36bf36bdeca
SHA256598652d94853723f97e96d6bdbbb0f63525b37a847fed2896ae63133a50eeece
SHA512072b41b92ee3b0d2ceb84c36fd34af8c1ffb92ac997b331eb004391a2066ab5f4b9ea4fc43efa60f4e071d2a46eb2d904de8867b8e43a1ff4337a638e1e1e1a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d96b6d70ff6c538db8f6074af5acf8f
SHA10dd2cf6a720402664ae6876d60a5538056dff3f8
SHA25634a0f04c2ac14e53b192b6c042324a553dbc27cd920d9a07a0bcd8d919961f0c
SHA5128f54e0228ebf9b463b565805a061fe69eb0697a503bdec4d7ba9421f8b1bc4bf0c4b064b3fb156e33744b7bc9f0253b341922944a609a47d01160fe9249e6fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5da48cb466de6c3f071f619f6f68419f9
SHA102d987191a56a76bb920a3713485a3017c46d8e7
SHA256696074d96b04e5dbef0a98a6826e5ecc2f320e2e09668b801cd58f6f1c5fc802
SHA5129fedbf7e88793d29b192e18c12153c122e3e6a7ad828d9e3c902f73f16250b3755c44bd734c17d80169f8fb2b942ebf7c4043d1c7bc20506ede1ab5dbf33d86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f87d1e714ad8f2c08061a5e27126870b
SHA19355220316d33636fdbd712adf546abb26986d14
SHA2560bdebd849085b84c7d3759d1f22c93258ac7df1d9fc254cc8d009ba07e30bb30
SHA512df91e2db85a633f188f1a26ab5dc77280de6a9a872da1fe4876297a3736d598b9c79b52bda512019389fe197110bfb89c6071410e7df718af0b0440133e3da4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dcccd13d3ddac99b955efc5cf51a47b7
SHA1c4143e673cb2d8d53916af7144248ad40338d303
SHA25671942c1b3eff05d6cb3cb997fe3eaeb67a64d6a9807a6c4fff7355b02438b7be
SHA5120c7508cfd77f0f5f196161f6f8d0835354c542205393f8a3234e9942d52520b5a46fd29ddebfae0239069c115af81915a6bf0d7216a4f93fea94c755212f9e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD508abe56a5cb0123ff201e7b6d19d56e8
SHA15993846117c77cbaea01ff873f59033a443ff9bb
SHA2568fb92ac2885ea09ebef324906a80d91651c4e2c70e40216c8ce35c4ca79657d7
SHA51281346f4a67338a305c67f40d626a87eb83909166a2f865eb62c36c157eea0ff441ba8d83ccb6ec934047e9a5bc3ab41a8d468ff28e22a2e0579600b688ed5ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b46fabb372fb0fba5861659f9120a5f8
SHA17efe8f0cdbce0ae1ab101600f6a25539748fbdcb
SHA25697b1edb75bfc9a7c3e6f6253424b32d4ad3cb7a583ce857249372608c119ddb9
SHA51221f41777033836dfad39e5b53d098d91e2f4dc7ed0329d83e2017a890c911e4d4269845ebf58465dbd3fc1f70a509d5a0bbd68b2da866da22496aa379056b543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD535a6c2af9bfc19f99078b2b7a6a36555
SHA1ea74ea96f59072dca50191ca2750c9f4b71d42f3
SHA256e621fcfb2eaa525464c1239cd91a9ad6e5ff7c876c3db0881fecab87a6494311
SHA51245acc08cc5839ea283fc487c19a6fc9bfca44f0217e89fdc4e470fac10fe4bd77dc78e546853050e13942c2e28918171c8e7eec945351343ad6e3f8b785bb920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eaa520ecd90cdf98da652df2e621589c
SHA1d781bdd2f79f074df51e42251ef4db13f2f0d4b6
SHA256bdaa5fb18d4d025b69a77081c950aaf55e9bafb5a158287dc765b8e1b222af14
SHA512e491c9c82e607678c6c897bdc28149a8ac2aa6319eaeea2f165f80be534a1fc67c94b07b0896cc5bfe9e1795b8cf35841382fb12edde9432a8062da1dd7b27e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD501ba7fb6244534d0f9370b5e796fc7aa
SHA1ac3a138b4b9f23651adeb0e73a0da8ef03fde7fb
SHA256783970743dc9b570fabbd5dee6eee8c9d32f77a1d5dfe483e4891a0cb56c5abd
SHA51269733b9f6287593d01b1786f31658a235b8abffc90d7185619cac269daae3f59a41803f0282cadaa6576ed78f5357b2d93b89c361ddfbf3ae3cd79b72d96e9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51470bbf96fd2b1631ff34def618af754
SHA131e5594d89f80f2a7c9db85ffc14270d2ee42839
SHA25666affc5773f93d916f18ae1d73fef846dfafb29aac68eb5ed59161e37c48583c
SHA512e3e111726edf5c4e2fe2314075dfdc24d0fff9c0407913daba5f0fc815a47d1d09800fb1e9667335be90436a76feea7d2a4d2ed05ce13905ae3b2b6953e2af11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD535a62bfc3ff5193694c976c96893423d
SHA19cc2c8a6641a889c93be96b8a574f2b02d878c1c
SHA256d181d731f2e6a3f1a71d68d1b572481679169f097bbe637a278c5eb60fb9d985
SHA5124e8af34d2f3de7d496d1e1ae4650919845772c6e68b64b910236b78be386c1d8ac1ff8990b0923590a558eb8bcf6ade68401dae593886d8ed50cacf314cd09f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52dee23c39e81f23064694738106eda24
SHA1040b92ad7562fdd2c990b72e2b41997094e85b30
SHA256cac556e0c4adffdb6b7ad864022c4729e3ed0e03a0ccc314d59bfd747b1b545a
SHA512387727a9bc1b98eed384d01a939a41864f0520e1911ed5bec3862ac4c85a932798755cd41b4bad87a3e35e4f1594dde9789b603befe1548df5fbe0c5e9121d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54a6521daf26db08cd398184643d6238c
SHA1a2bfe81850cef3c998cff9471054de48e1eb1a79
SHA2568a8949025933299eac478ced135485568112657dafae81852aaf10ec1c61764a
SHA512dc85e8010c7e81fb3dcbd73a5df7aa2cdfd3270d326b13f5c3b3db5319babd1da9332a2c746e2e52a2483c4e10641d81b2c22b39b9ca95f63755d2046decc209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD586c08cb5cfeb613767b7918a865cf48e
SHA1c2d666a28ab50653a3b2c745abcdeceeb576a52d
SHA256ff2b5c11be626852c9a0df56813c645ba78b1b523ef2dd9c4178f3600bf17214
SHA51211f56781012fe74b61cf18f5fc1e12072c3a2848e94791c6eb5a57696621b1df4a25634ab8dbffcfc3a777c9b20cbb55cb956dc70e123bff00271bca62878e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e894f1be753b2817e9afbd1cfb8eb019
SHA1e670216b37cdc52bb91055ccc46e05c66542650f
SHA256b798e287764c661ca6019e8f77d9e0f36bf937bc347bb264f13bef40a9343712
SHA512502384b4b4feebdc96b53ecb8d851b8efca6329f18f3762370f1e1af8f814fd9827500b4bb53ba8af1ea8cbdfe66efac8cf0961b5ba0087d1c6ad8fe57bf3e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51691322970a9eed016a595dc6cf1c056
SHA16788f41b8a46dd91973f24618ef5cd678d860598
SHA256d7a1cae2fff99742bcc27d46a25817c6697fc5acdf35ffe2181a5a7731517b9e
SHA51253d1ff8dd93aefdf5146566080cdf5b0193583c60439a206b761069f29499084abe4fbff0905ff747f588d0a78df12e4a3c516906f7a372291994eb6e062cd5f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b