Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
272aac26d16da45bf448ab694ae0e02d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
272aac26d16da45bf448ab694ae0e02d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
272aac26d16da45bf448ab694ae0e02d_JaffaCakes118.html
-
Size
2KB
-
MD5
272aac26d16da45bf448ab694ae0e02d
-
SHA1
62ab0fb15ab762cdd39e4d7455d2ed7f7cd9a5fe
-
SHA256
d9a792bf10e9544a450f92e8c9b9debf0680d983101c944e9ae11a400423ad1c
-
SHA512
c866046e0bc8ceeed737ab5817d60f4d420d1d16e8f0d5b8f91a173f1c1de245e9544de79e280337c733b8c02265ae8b1d51f9cf0a5effb8232fec8a7a1c8b45
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000571bb17033bb8fc9d48241b5347fced7a573b6e89f26c3dbd164cae63ad78dab000000000e8000000002000020000000b9a670d5310a0bc0e1d443566f6b8e50e9ce8a06d80ef8a3c439ed523182cd70200000002fd65749ecdef14404396eb15203fb02d6af82ca28fb31364a436832fc14d057400000009bd47cba1d68bd9aa2c4688a7c1e918fc5d23c76f9fb16774057a670c8fb2f8f10ee0ed67318be8487b5265b7a0fff94681d9139b107756bb40c3ac07da1c2c9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05becb39da1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF446561-0D90-11EF-A1BA-6AD47596CE83} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000054eeb992c981ffc2519491d718e4713aa71da409ffe502662f7a61610a7349db000000000e80000000020000200000009365ae3324f2eca2ea89ca86b6e53225830dfc040a63fbebb7771a189433195a9000000072f98b1b49a80012627f13c962a907bc6b38372b7a806ab777f08b44e54b0251360cf34f772d2c330ab387fa7be0512f60dc325bcc4dc9a66ca8f35e3c95ae1c9a241f28e948e27269dc424371187079b68931dfaa5853c30b0a01e05c194c07885a4e96e3ab16e0901d7633b42b291c47747b2b7871c8685eab1b8fae903ae6d0187638ce37493d9f272b0c5460e7c040000000d5b450d0fba0aaa3bc6249f8b7073c7d8cb02ad2a623c84acc8ba09b6515e847b1c235d4a9199b05e85769b66bb972676dd33fcce42082cb3e3d8a9b4619f778 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421372002" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2304 2908 iexplore.exe 28 PID 2908 wrote to memory of 2304 2908 iexplore.exe 28 PID 2908 wrote to memory of 2304 2908 iexplore.exe 28 PID 2908 wrote to memory of 2304 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\272aac26d16da45bf448ab694ae0e02d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a32598b612c8cfa2dc9784b348e97f7b
SHA16582add3471bf3e5a71b15b4bd69b5b33f9802a1
SHA256a20451659621beafabc5d85c85e3339af8f578f11aeb606e49f657f5839cebe9
SHA5129b3c84e900e6d17ae7f6d176d5e1b37882a04425d954d243da0dc17a6c98d099ca345faf45e0293f86fd3e3877beb5422b98ba91924affc83b859824f8313425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5140bebb09e7297385acb3c630b9ac5e8
SHA1fa4b623baa5336b745c7d69ecff9b3db5f9f5406
SHA2563ecd22b307458aa51ab006f062bf3c69d7b92926d5b3ade70d81eeb9ecb8a98b
SHA5122540d08e035e98a36d416a3bdc8fcb02155e769d82a3adbfb74647c1d6cf1e341fc5df7b64b756ccf5abccf0631bf444dda00009c6bccea894044cddc5e08ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547e33a8536faab896b46e8d0e995c898
SHA17211941dce258f5c9cd8dee44c3a778c220d229d
SHA256ee094bcd06a8bbf2025817bab33ed36fa9a0c0ad4d3aaf41a4cd3ee9cf4186f4
SHA512c51b6567ac0772f03370eec419feefebab046b9a6aca7782f69838a168379317ad9d9336e0a7ff3509020fe4aa58bae5292ac83ef4beb0badabd9571f9421dd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d3bbf82e22670b805e150387838516d
SHA116c24d27e5a9b1eee7ca17a89d1a1791413b5427
SHA25616028c70a776b62b0339ffc09dc888fcfb9841757bf5c3a03031982055723eac
SHA512310fecfd51f0d1e4a40ff70741e0dbe9ac8a4718a5a302dbca4d86f35a5cb53438dd2d2bbcc18c23328b9f5cc1896fc934ba5546c15d9c9f209774b86cb522fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f27ef2d4ac629800fbba3502869da1b6
SHA1c1ca8d0f5c0ecae62df280c62efe011413b1fd47
SHA256ff094952e2ac9dea3fc65b3a8f3a738c5099ff354f5c8ff1406b661a9f520d19
SHA512dfb94579443ca1389401cd3506a561d18ee665764b729f9cfede7998399dc6b67b8b3cbd49d200f59f5cdcfa012bbeba87309d4643da794a6ab17fa5ae14fdf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ceb65dbcbcbcf3a4c25595af598989a
SHA19f4ae5969449ede519ab244f92e003e3410a0714
SHA256e6eba64666ccb56fc33c429d9078e3e78b7b31503f89318fb5d4cebf06823e7e
SHA5122d9c71b5ec6eef8d2a2f24e6ea55fe0c4260e08c8d78f0fd8f0985731cb178ef34dabb32f674aaaeb6146cea94274c62eb8387d9ab4593f15fe87d7a667183aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d49f181ca2eddffd7644cf8bc665e4
SHA1c6bb9bcc41557d8d3cf303fb7c9376df0cbf720a
SHA2561267d8bfb2b0af4d134d6010afee24ea5c0840cccbc48de34d94b5c7a77a947a
SHA512d40cee398d6e0f350644d1f0a67644ca7b9c3caf4654490b1e679e23cad89db8d22a9ad952f288cbfac80b7afcdfe5fe6b919fbace0104f99a5ef6ead6dddea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7305fbb8ccc9943f0e2cf7a2766cf39
SHA141f37df011032abbbc485539345950edeead7cf9
SHA256540dc92314bf3aa3ebd4a0902e56eb618f97fff7f773608f0f402cf887e3e8f3
SHA5128e8e6c2bfb78db21c84edb35e23f7f6b8efa1dab3123c05fbaca9cf98df06bf88be2c7b031183246c898ed6fa26a57f4d75063c0469b4b594b9181c1ffb9a696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eec53ac0248a68cff82f3f3211086dac
SHA135db9c29ff35ec28a87210dee5e0d2288bbc8709
SHA2563e73f2b90eebf0b4c2473496721c142ab87425920c325e4868452e2ad1de50a7
SHA512e197fa32f3d6bdfcc9f4091f5d0e6476963a1a17986346b38e62eb73b8ff9c8385da889fa100a5b37560eb3d85d1fcf6a9e6bb504e756c9624197bf9ffba6d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bd8575d5b18e8c1104b2034ab4756d8
SHA10e4ed82faf99681e57ba3b3987f582c13b20b6d7
SHA2563c92936241ef25fe2a56c30ad5b7c2e022f07dc920cbce971d8e9be33ad56790
SHA512f60d86505aad1da46258d8241a4da75542392ac92d541c637fddff55cf4b4fe565c7746a3a59888fc5127b098be79fd8fa103c5a193ab1b3e332832e4b097559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f51a8d4afd0f5764ba14cc6d109af637
SHA17e925eaec6aa08029806278c1d2432c2a0198b36
SHA25687ac60d9c5ac1c3440f06f70ef94d4c0cd00464491d6c541da8826881d006b74
SHA51254554adb6c1f679b832a497c726e1c45f4238e5dcd89399d3ce0ec7a5aa90634947e37550be3aee47c92ef72a5d8210f1d7c891dbd90e032ad0789ebbba0f0b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5099ffa30fef66bab4832bd185d526df2
SHA1702607c7da7018f07cdd194e9ee1811fa664f856
SHA256878c554403b51d252ac3c26b2aea90506999535d26eb74cd97565af8d85bc8e5
SHA512f974a8c00599f07fb4609fb164b68ab949bf49607b3ed6ff41a12fb43a2aaadbb96d8dda3978f116c6803965436a60067638bc05ce2dc10cf4e4d61fb0396cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ec16bc77281b9ab12cfff1f274c5c5e
SHA146602978dcdb54b40cc62e93f2b938ce8769ee04
SHA256ab2ee6a1bde77ed7134cbd30f4aaed54969e21c9595a45e6dfa46a063276158c
SHA512896e6387f0e7471e1c2d75c8a9cec95d30a1f1b4081cf42da788f761dc70e6745e7d5e4cf0fd37fbdc332064d6a2f58c98e8cba73252227e2e2656db914b2c7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b032d2392ecb53dc5a7d9ca4b3fed8f
SHA1f128fd860cb76a3775430aa4eed67671a6fcfc64
SHA25645b93eeb6d921360c41f152d52653a00980d57919111c11180e3c7af1bcccb87
SHA512abb9dd39fa9d58060c63f4547f5200c9511e72f353b3ede5494b075f43a226a42916c1c6a5564936c3db6eca8318b71b22c7a5d4aa02b8742f3ea6dcf351accf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be59b11ecd3ae0755e463ef1db91df52
SHA1d7ff748c7948da353536d954ef84a5c6de8bdbe7
SHA256c7ca548471f0533d573406884fd0f955554452d0c01ade54b62c718ef94e4dec
SHA512356dbaaa653ad836d4d13e8754bba786f5aee4beddb14a07f106408284da60680c271211ce7128d8bd6d07eb23738eaa20c3d830f16eaae648d54849809af772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b60b2c8af1adab2e415af5b4075fd8f8
SHA16412906ef76ea7b6b119c26a5b9ccf145bb4a2d0
SHA2565162307ebb7bd91767e0c8b4f35bd3c01c21285d71512ed9a8ef4a783c38f2ca
SHA512c5c598901f2a2fcb37e5b42cca9205bab20e8a94b12c990b7684196785a38ecb6b059bbb94069838c4f1982d066b7b9237f608ce721c85af8d31aa3bd8905ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fdd916ec5fd3954dcac6317ebd70c6e
SHA1de219f97f6da4627e3fe06620a7d92cc88e9dd26
SHA256cdf310c699c8cc20336e8a8e391f4572993506874bb3b3a1e47ed448f2ac689e
SHA512a9e32b045697cd889bd952b8d004f83e4f2f283b871d359837a11834125c4f3a4b86793e87d07bbc8b86f04290fef57b8e6dbf30b7a528ece3c9b66261f127da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7623a1fc9cad5154c454877a9ad8201
SHA1d2dc33d3ff057e668b3fea2a31fd9d2a69c7af5d
SHA256af36465ab79569445bcd1232117e7ffd1893a91b1d24f11076a15c982ad30976
SHA5122bc22d8833568df06f106ad9488c2d117d12e8084adee974dfc9bd4241c9a8264e22a99c52fe105017e145963a8fa60da19715adb2e4a41bd278fb7b208435e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e9416cd0864d644e9ae41ea1c0d2797
SHA1b00edade2e9e85174591eafc44bab5d52588f8ba
SHA25675c6edfed6cff47c51e3c39a37af45c2c015194499b33a26a8554b0b53457cae
SHA512274f923c504e3a6c15e82b1252b207b780328d943b11165d9fcff4bbeb4a910a2468d53d80c7cd0906306c3f5b14a46c33f4d980329e56cd23fd99ee303c19f3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a