Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
37f61892fd39611cc459b9700361d0fe_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37f61892fd39611cc459b9700361d0fe_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
37f61892fd39611cc459b9700361d0fe_JaffaCakes118.html
-
Size
10KB
-
MD5
37f61892fd39611cc459b9700361d0fe
-
SHA1
6511d79420c6546b39dc3672c7ac7c81656c9d5e
-
SHA256
402d6c9f70543e25ed44961d991b3b44263d8a0e38ff29896671a6c667dd8327
-
SHA512
d8013d45e03d02478d4d3ad468dc6d82d28bbd538a5daec4daa51197603a2f106a1f2b8ad4b7d78b64bf23ce0b20691cb1dcf944f85599d53add7032ac8a569f
-
SSDEEP
192:P+1iFsExZkoImtmLwBkRyQawJ1WmZvfGF05:ThFkkBPm1Ge
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000008030a869450a45357ca7cbea42cd5aed49f4cc1cf3f1e3d0d3406edffd83667000000000e8000000002000020000000a5403b4528e4f9cd79e7429624a9dadf78fa0ac36e28bfdffa503aaed380730090000000d50ffdaccb4f04f09174b0de9c21cb9bbc312124e79a33c7e482f0dd2a69a9253dc7f18354108a8ddab0123c71fee97047f8a63e59bfe6319a072868863a99b551bffc43eccd4a747496f0eb860bc5132d8e87c0fc0b783007d0b9618ba1c21e9c7665a78f1b7ee3deed05362c36f121a1c63803b06753f93b1e9d1a0faa603f7f52e1087e76043e295a30bf570649f340000000a059743f7352e671e3f70c0d8bc9614cdecc3b97b1e0b5c0460778cf32f7d542f1022df3da753b1be44f1efe5c8c6bf8b2e4ec61cbe99ec8d79d6507d5d43f48 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E28F5221-3F4A-11EF-ABF5-46A49AEEEEC8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426839501" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000044582fd9ae9841873518d6cc9c15bd241c157d286ae64b5b5f618a58b4fdef35000000000e80000000020000200000009e31df17fd370868ff96491dbec04fc8d39d3cb0c365c3d15d8008541bb73ad12000000090e955d39a73ea85881d83a25772c29301995fed3923bbb872954b5a6fff5ce2400000001740bc8c05656e16aaa3368f1e6b3938c563a9b48018c775875ae8cbe8aa9921ff8f1859a63712d98556494444e42a0385e413866984489e1ec65cecd6af0c3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1089b6d057d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2784 2856 iexplore.exe 30 PID 2856 wrote to memory of 2784 2856 iexplore.exe 30 PID 2856 wrote to memory of 2784 2856 iexplore.exe 30 PID 2856 wrote to memory of 2784 2856 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37f61892fd39611cc459b9700361d0fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57542ed2c1338ef12ac608d3e64d31b83
SHA14b3d64e9cb87efabd4553e44150e7a7a6f297d58
SHA2561fd18a95a3e371d55ccd7e9dbefec204eac94e05733e80d0f8cf9910479931eb
SHA512f5a973e79f8785de91f292114805022f90a77f88400e27af3688827b9a48b69b88e83cb79c9e213d801771079aa6d292cb4f227d61b52bf7d08a5d68af42b930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54f8257f2dbff00b48a62e137ef939b54
SHA1f6948bc6a662fbc09dac96d5ac1b734fe5b6b547
SHA256b817a051752ec9822ace8f1db627bb9f89c08d27465c692888834bf34ff9983b
SHA512b740577dec8175365263b8e22d6eec07f7c8386503e7cfd12f2e8a9c5d19960e9db26489d83ae47975db2c88cbf9d233eba4b9be87d806e4d7fb0bbcd21c2235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD532154fb94b408b1156c6b039659fdadf
SHA13492ae069cd45e6d7d3d70e346670560d0a98464
SHA256e297991d654675cd119acc7f6188892a77ad901a15f9031bd6329362f3b79d50
SHA5129e7a6861fd1f1895cd35ba14155a443523edc7183f90040a1fd3f35b8831c21e94c6c131ffaf58e48c92fe9e8e1e2069269632761108f0dee2105b5dabddae39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD540a0fabbadecf94af45bc5b80ff921ac
SHA1c9b79a633f0abd5e0dcc26ecc49787f8ad599598
SHA256571f81e018194e0f171a2b4b0624eaad6a8ff1b0b0c1c00ad0f0fb088ed35543
SHA5129f9926484b43cdc1d2aabb7a13951eb4827df8640ae65a0e4681ce300074df485b90a4cedfcf165a2e233941ace433cf0529f736dc021886900e670654f33842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5457157de9c9b5f1d1d34e7f3424047f4
SHA1e1a1da058f45f3f264561be6c7c7c5032f8aafe9
SHA2568bdd0c58b063f75e9b117210ef78a23da31cc7cc1abb024af6e76d284520f83e
SHA512df4d15bf8b7844cf51b76965c48e3f888fa1b6ff14a5561d09e9aa31149a9c3d510f6211ccc5e0b947011b641d123e512a2db8a2f81454b3be50bb5b16346c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d07ed6e0492a87d0fc60675c58353970
SHA10f7b956d1719b7c9cf15da700260acb0db000652
SHA256edd0f59d65aa3ffb044600b3f6ef9caa882ef84397b2c929b808b60d762a8055
SHA5126d000aee3f7ffedad65c16e5f11dbf0b64259e17e35f92227054a6ce1d6a2e5a17a5d40f25b768bd76a30a413e0985f5047c427bed49f6d34357f56d617e99c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5135cea3a9f7705e52acaf133912196ef
SHA1ae019eaffe0bb4676a951a798c895470bc15d3fa
SHA256522f3849feeb3169be4ccd83cb6d8e53ab9d5d238ce432ed8dd265f24b152041
SHA5124c7db4b061a8b7d90191796826730d32e16a990525c7caeee3608fe9e45be5830db1363b3827c3ebc859c6d16b73e33a2020d32e5c6c0f2dc77b689d4a3b0b84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f52e442e921240a6bcee414ffa97cc6f
SHA19fdd9425b8f99d3d1e26bec045030c1963317433
SHA256cd277d67b200c0e5765d32c2ea317946bd3bc9ddf3c1af8cc429a0c24160605a
SHA51227e201fedd05c4bcd3ddd23dccbcbc649d7180806bb8b185315374b8e5a4171a99b1ea154ba0f073317330094526999e4b5d2bdda234d862fcab6a6a2dd86550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bcf57d143eba8510e0d81fb88a514e59
SHA1512c38105dbddcc826d799b1f4e7f92f6a4a044a
SHA256bcb65b23eea07c40bea8516ff2f88042485163c23f9da8b76dffc2e205f49e92
SHA512a11e04695ea30a66a29dcdb0c52e25361334122b37979a028fbe7dbf8f3d19e4b8e4dc5e6adb98557bba5d8ee31f6d6ef0e4825397166618b091441891b55b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e2a1de75d751312a86e20961b8ca3edf
SHA1e79790b80439baa8c87b321a0f6129d394fae253
SHA256eed9bacb1b21dcdcab88cecc757cb97a4862fc7f00076fa04c0230d77b5f5de1
SHA512173ff18f27287c4515bd1ca2590fcbd9536ea172d7a5a8d4912c989036b32d20880aa1253afda00bdd5afeedc4fe4bd3a58e3bcfdb53ad70778766375da61673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5452f0e39f58f8b1492660e26aac99ed0
SHA1568816f828359e7a57e92b4969ed04f0244d8f92
SHA256678d365b9a33db00fb0ab0121e900d845610c1d4c1351463913af513b3487178
SHA512901ad2b2a51c863e79d71154e14ed6a91fda73988025037018b3d04f13d069e5ae5384ef0812fc3ed2d6e64192bd04e39f247183ec56a25800e28dcce391147d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51ef61ab1484e5c29e116a145b36828c0
SHA1f8c8be5d7cfd525f9eea99990dccb17ce5c8e5dd
SHA256a1d356a2c638b6aa19125bfc0aa5dc94d50ce93ab5bb165045f0ca7f9f45225c
SHA5120f3d4056541b1ff44b25aae5f017c0ef27587fe9f7e4bc4ddd312b84f1108b693d7e27ed373e085de514c283312f1581751ee7d7fce82e207358b76a59fcd0de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD515524b569e81d7c0ae9aa30d35529540
SHA11cdf71a4745e6eb27a22acf16a0e8ff53dc72d52
SHA256712e4de772dbf07b5d07874ca7b16b12ce7fc86be3dd55f8c4be424893403ccf
SHA51273cb907f0544f92e319df316b4192279a92c3091655cafc6959e759abe4ed4c1d14e010fa97abd8a949d8bdce7d3b947bfe256eb7685808e82cf381ea6d40068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5df05fffa6c6477c7c2851bbd366030df
SHA1e1ebbafe9dd79f01215290a5f1b1b54daddb6b78
SHA2568a681345969a5c937c49a201cf2053b056cb7b44e8edc090aa539e4087fc4dce
SHA512071bfcc2e191a6500753ef3a3aac925bdbe855c079b6df0381b9d730e23313a971c5739f721b3c286626c74c6f6243704cc3272baa1e54f3f9004a6cd0df2f60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fbfb17556e4a0a9d171ef8f6efa9f217
SHA19184a98a8eedcc3d5af358bc5b8533b74f9f14a3
SHA25627873617d5c4696de39a888a1cb8afcea8926726f861da329778501af0a0997c
SHA5128e5dd7bbbb8f96138ec2bc339d689402f1d6034db6e2ae786e977c95470591a704e4b2cfcdefe4865b98090382f2d9fddcd72863fe40b0db416fc13d41d4025a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD571f885c3d3eb5add1c18331d8d5d3e55
SHA1c3c5ddbbfc46e1d25a824839f0587448ccd5eff2
SHA2568e79301817a8f751f7eb699d8dbfe3987016188756c649a4ccdc45343a5c5670
SHA5128b37fcdfcb38ff049b75eebef57b28d93aba20077087f47793ecc5bbb906b0efe4215e204f1d4ea9ac7b3ed9c594bccbe3e9cf3b798f52bb01e75c4c184d3dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d83cf771a7776804ea58d5941c3165c5
SHA1d1af2ce6f0743c50ba53652493aa42c0f713138b
SHA256c6f825379ab5515fae1bf65df25120afb2e9e21d06819a6c794feecc7ecc1e46
SHA512e2aba7f102a058ff93e68a1a5e823e0b3672bd0281e0d91dab5491d3ae1aeabdec3a1c21a92aa900970a52f1c54588e73d19302a8bb339c30d39ad06972e93d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fd4f32605b7f0e4187f63e566cf5e90d
SHA15ac3835262dfbb5b9371b546fa54dd9ec9ba79de
SHA2564b431dab3682e82b42d4e429386b49d91bff4eae207e215848af3758e9273d45
SHA512e9009fc0663fef644164f6fd9039cd25dcbc96b004d20bce36c4e38bccb928f711b2c54118bb6aa805279301445531b2f61d7486fef42e837bc79810f24dc134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57730382985ca16093c8ac13bda199a20
SHA156c438da66ec8fe22db0431e635b1b2bcbabe2fd
SHA2567d83d8d98bc47c641760c891c6579a527209e61fbaeb0646f1569be148614fca
SHA512c728880754367652218a26ba280e805cd34b35bbdae611018d0d083c357499c8bc9bfd4507f32f673cd2d773a2d6aa09fd5099e407272f689b9a0ebdc9f326d3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b