Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
eb6491b0cb76e2383ab50228700ac890_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb6491b0cb76e2383ab50228700ac890_JaffaCakes118.html
Resource
win10v2004-20240319-en
General
-
Target
eb6491b0cb76e2383ab50228700ac890_JaffaCakes118.html
-
Size
1KB
-
MD5
eb6491b0cb76e2383ab50228700ac890
-
SHA1
9360bcc031e4f2057e7242fff1a7dceb72131d71
-
SHA256
af095e6d9e7c3697fa826d26cb0cf7ad9c3b0370cf838ecef015070073a18bac
-
SHA512
17cfaf75c8da9b43a939b1f707040cb1980ff4068c6aeac34e1a3c422a650c5d67215e1f434d5d80c3dfe7ce596c7d5826789a3c486d65d0a9348e436dbf4b8d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418925005" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000d3bf5fa0feafcdb2291d3a452ea506c184ac4b12b9ba1488b563f64998ca190a000000000e80000000020000200000002f954cb1e44f7bfe7a1b5c5eba66cd1fbd705932afe82f08d6034cd35bd2db209000000095d771f5a55505c25d162459ee1c4973ffd91bef986f5798381c6f24d87715e1bfe8e20a5334f479943d6486a54c5acb6c360ca104976f00acbf93e59985be55d2a30c0b9a04165d7a0fc2658fd2c65574d57bd35496fe2f08b268e29aab43b5c80c53a20aa68972d487b9d2b4d0affb2a6d2297a61ba530274402e786b7bbe3e465de3ac2333e0c9ba58c98ca60224840000000c67ce1da7a4359ce7c27233ea857e93259d0be8f2b03a1a44ced49571bf790faf77a5a676dc6e51187a4712f7287bca3934140bb542382d3783a776439cd6b53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9013b9575c8bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82B418B1-F74F-11EE-B54B-6E6327E9C5D7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000008556deda275e8704a88942ec40eaabd85410f9f0cb739d73783982bde2f04704000000000e8000000002000020000000b2b739a83425a006d443d091111c5cd1b18c82408b3541e36a058d79e06d1d30200000004b830be06252720649650d5cbaeaf488fbc4e8ba7857d88cdf9db63f491770ff40000000bbd5cc6433bdd52618166f87e5ca739a61d6c605e7917e9a2cee65363d18f61fe7bd0926e9a07dc0da653d15df629a77ed6750ba5eb8526270c0680dc0d68062 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1048 iexplore.exe 1048 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2988 1048 iexplore.exe 28 PID 1048 wrote to memory of 2988 1048 iexplore.exe 28 PID 1048 wrote to memory of 2988 1048 iexplore.exe 28 PID 1048 wrote to memory of 2988 1048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb6491b0cb76e2383ab50228700ac890_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1db27d39af80862e33af2837fc4334b
SHA11f9f43d9aeaf9e3fb42abce34e4d2007bbf68160
SHA25685ea61dfec45fc03bf389cca7ebb9ccbb8e6d2f66ba7ec921e560961fd1ac1ce
SHA512aed08bd6d1848ae7dde98491f371d2317ca1cc1d62dc0617c2066c7b3686e8c2a98acb398e21b1226d4cd3d8a24f283e1f4d8c4b75e7ff1c1f49809ac936d331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56953c8f0ad3ff06e53d79ee812730698
SHA127835eae3caab841f63662a6ddc61739933b6024
SHA2569f9f78bc251a1aa61dab1587687d8efe3fa1495474e204834c4ebdb3ee048986
SHA5122b52a69b58c503608bc91387721dbaf168443eaae1a6d15c728f07367b1c4a4cda1024199f21fb0d9c5acab62f8f5da9f6b36c19ed939fbff63c92a022a1db83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ccb602b8ccd3ac5880156f80a49e8b9
SHA19ad4bf497ee27596f69c8fc9bfb0b89cb8844241
SHA25691742bdee1e13d21cb57dea530ad26f45b2e251bf019c2705736fc0dffc526c3
SHA512415783f26a312568b63fcd5231556dfce661e246cd71e28765a5b1fbd5cebb36205e47d77f10203a48db79bd1dc4fcb7b64070c42f540ae9402d0f084fadaea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538a378f45401854b1116e36f4a2e156d
SHA19fccab02fff74f49ca4ca7ba675197a4b4e91c27
SHA2566f6b23c89fb465770ec7208260c6eb92a5e440288c182c761485aaf89c2781b9
SHA5127cc5e9a1e6bfab983af56a74e49846f0cc48db90dc2c6f83b2428590dd2d6cc6e92ff57bb9de24705d7d1bfbbc9b07a865cdbb785f013b50e94a978619ce310f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c16b380894ac38a12fcbbb274ee9f461
SHA125470bf83469862fff971c8fb978a039aae0fcc1
SHA256605d5cb86e223d7733f4df236f7fde1568dbba5f85dfb6a3238336a331b32ac5
SHA51231137fc2b7230bf520dded1844685c851be97c19b6e418648660cbec47873038a3f4d71a19c8b573cec9f80bd3050c38a03152271de472c9095679d593055299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fa202a75530a7c9c11307c003bd6436
SHA15846dfb15de34a6142299415d24a70209bbbc479
SHA256f4d89a2b0d36f887ff006ace64a0f6037c4ef63434a117cf7a62823302d41b1e
SHA51206bac359b28f031365973d78dcf3e59c25d7bf50e41b3990f403152bad16d593387ce12242800be3c30674659035a6df049011e14db13c1ba435d21ff52a172f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bbf050369b8746c51f0bc1402def341
SHA11ac92b02b9a4eab554a256977b8d4be008499f81
SHA256453ed4140a037261fb2707340f902d70b9d655caea74afee51326a8c3a54a3ed
SHA51232b25778c1c702ba0f7e9c5b7c441454d50ba828885d75c1a7b520e39caa40dc516d73202efd06d17351852e25dd5e1578df2325bda05e28a4bc0a98101dc209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562dd6b8741a17305feffbdfa647f422f
SHA110f8555c813cae9895a7fc7706412300d98cc1fc
SHA256343b189a981ca12754671d1d2330a40c811fd0b3b4d1a7fb03a2264a9edce68d
SHA5128fa57558b13002bd52b87d044223be4dee7e296a4b4a116bf60f73846dfdbe18f747981106e92330737ba9c58c21081324a659664c802874ffb6ba4aa8787a2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7529c1b5e122ee1983d823863274410
SHA1b216a709ac5ed36fad83e7c52a01da4ad76e31e7
SHA25629a7a1d39c945d13c45c7bce1ac6ca1f739d8ff8e862e81afe2b282b36bf6b20
SHA512dd346fbf6e6b088716e941f55a9603bd51a3c279955930a13686b9c811714d2bc856b6e490dc16a29029b28d3e5cf4eb3ff040cdba78e0b661ca7d7bd8b8275f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a47f24e1ff994f1a1c095681a85bfd8d
SHA14d6e586accc8414dde11332fabf85c26bfea7fa1
SHA2567820836464978e1dd28706e7de645255f731fa07d81b81cf9c82161458f1d4f8
SHA512e4494e3c610a11fd720448925fa8ea15db0215c2bceb7823eb10dc5b627e4c2480dfab4622c34439c03e85f66d78526e9245cf891502445b3630e92223fcedae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3ed8540bafcb16dc234d06514a36bef
SHA1ed1f44b8d23846c9ee5f4e815535248dd06facd1
SHA25616087deefb0891229633bd899fa1e1ea1e66ad41dce906d1f7ca521b2f1cc731
SHA5123fdab418e8b62dd0ab1e14e0196be89601759a895cbcc2b3bbbfe681fac1476e784543196ad67ab019f5fa9795de36846e99cdddf01e0ffec0599fb0b01d32e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568c401846e263c7693bfdacc1635d508
SHA1fcf8a38f9c7164f2f6e742d34e398c71ea7bc3e7
SHA256461589fa0127462615cb5d344921a313f72a817ff1d5edff7486732f6e5d0f5a
SHA512c665e022cd8d10b03813802055736635e644d819acb33dbf2238803adac0f38bace758f94e344e0761a1aaea8a930681a6a7bc63840dd74d32f01318c382f82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55151a6062a0d22df9cac507903f17ce7
SHA17550c3ef44616592c3db04627dc3b731a214111a
SHA25657aff2e2ebfd4aad4f54a45232c5426849521407706f2c0e2d248d35359365c1
SHA512ec232bd809232e09a4cabd24137b5ef8763b7f17da1d757648f217a9756b5de0b579f013a39f39dbdc9d2bce04d9fb529d14cac86d6c85323bf95a4e1668af90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564f01934cdbaddde72458ab1d7e1e225
SHA10a8fbea31e6022327fa1c3c12ad77bb5adee19be
SHA256679ef36016a44158c2719c2a67dad0ffda8d234f1723a94b3f759a92cabd8dec
SHA5128fb73b551d646ad0cb8a4784c5c99f99d482d22a1d79dc494f1011fe84a276acc935b14a5492e6c5aa56c5cf5977408c0a8181e864eb542dbbaa32ea5602221d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5113c0c8bdfeda11f4afae13f84cce98e
SHA16ea4b6abbe0320f1845c0ce565f521f6bcaec64b
SHA25663526125a0b7d61ef0096a55ff5bdb7123cb318b060eda596e22f35ce1480624
SHA5122f81c24fad5107386e9bd17585ecad9a54114551093ed35a3a059e3ca544c87b3b5c09964bf920a7d73622f611efe685367310199f9c3681e024a3c5ed706bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53451c5a296e7b47618a24dc8220c5df1
SHA17767b3b807ae8b7fbdc7ead91eb03759412d6f94
SHA256d8a77b71527e3071c0e3bc6a2f1efc344468f107fc8d46ffc1690590034c8801
SHA512f492f62356855047ae6e399bfc16e7d90e1cfa50620478b75766325c7a23f8e0383ed7c110258884514bb88962a5bf2fd64cb5475c59eedc6b94863c10f5882d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c28dacf09a4a8e28725946d9156f0f95
SHA134ef00d4aa83f429af3f5f8b883404536cc812f9
SHA256038070e350db05844026397d45f6ddfb89b7aa58ff069631d044712f5b1f4894
SHA512cac0fddae98efd1e000ac9b35d260252f57bea0ef0e46ab190b7e0f849e1c9545bed4334968b1b465f1df7440caafc93326283b614dd3fbfdaa78615461c6616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cff04b6e478221277bb97bb9d4c06b4
SHA11752df1a19b702620c74a767ae2fcb1dbef38ec2
SHA2560d44c731a58a03ce4e54f044601ba2d7fd39e9afd67293a61db22faf116d309a
SHA512d3af1d2e4d9ffc00acf955909ac20e8ae38496242b5b25b7c21e6903e22a32d9786bb2563968e8cd33dee0176b9736e10f870559ffdf5cf861b8e6642e9015f9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a