Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
2a4bc77a8c5db6a0341946f030e95b21_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a4bc77a8c5db6a0341946f030e95b21_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2a4bc77a8c5db6a0341946f030e95b21_JaffaCakes118.html
-
Size
4KB
-
MD5
2a4bc77a8c5db6a0341946f030e95b21
-
SHA1
02e4504fc1ea2474608cb322b71d5c801a3c07ef
-
SHA256
c1e40db9d76534e44ecdb7e461462665cc61009c6951e0db679cbe15afc4a21d
-
SHA512
f5d9fc6ba1341741028aa1172c81b09f065c639a544228cd98a0b31b143b9409840332510feb91b3f01e080e56e88ba02ca7f80ed6e0648ae6d0eb6d02ba1d94
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ofrd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD6E5BF1-0E0C-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421425176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000066ab304b96763c2201bf01cab6c31a12928cf972ea6884905474a523579ab3b8000000000e80000000020000200000009dd4b7b39b637d8afc2fc4d363558c7ba89c32598e76689447aef4b333c5d49d20000000c5c003ffc3896ff50432270b2a7c2b7d8507ccdb982834c0a5547148906b8f30400000004b4b6d164cb800b2e55ab7499fc2c0868ff6e8c2f9fc459a78d434ca11bae17d05cd4708a4d11901c9885ce7dff53e99420b493bbc57048f20d52da21ae91248 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c3fe8119a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000043da6bc1c2d15f6bcbfc307b8bdcef97065672680becb4a0ff83c2364ba3912a000000000e8000000002000020000000dee8bac8a689fdbc6b7076d88026bb0b63d6341bf56086663145d21f47d7062490000000970c4cbccf1d49b867206d61aff561d584881c32fe042b49f7fd959f505e93c019b37c88539285391039febdbf20019de2daab0071c8421eff4b20e5178ac839436023182c55dc04e4f7ff54168e97fc71b9d5819e47941f6cbc4c567983b619311d259b5a6626fb7751249c014708ee4f071f2f9877aa1a637e1f4e8debadaea467932f4512586bdccaf162a6f377a44000000097d4794a8a5b220b168e8acc2c0d3b9b7cf1410999c42e1be7d784a6dc79c6360dc02e08c03201da21d11e5058d114fea4eea49e77b6cecf78277c906334914e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a4bc77a8c5db6a0341946f030e95b21_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3d2ca422a109c758bd8399f2763ac17
SHA1e4304101810bd7ba8258e5a4413c09174e6fd5c7
SHA256ebd3d9a9bb08d8272b3990c5ef913a67cf61c6ef099bc97c0e8402f9e5193b33
SHA512d0fc10d278e6104fd8a91300db9181460a820ebf627418c78dc7a7e080aff878f3132bcaccb373ba2aa28702631b64e10d006efd1a8043ee3eea4362baaacef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bcaf837efd69ddd8088a4dc9d720252
SHA1391e40e9683af05c64e5717d8cc30a99bd498d02
SHA25634e99d8e0769a610e221aba30d320f96afeec7245c6a349b284fe542f36ce788
SHA51207f7395763318871e47594221a6f6a351bc1c3810859e14d01c9e2c671a0149393d31906823c954b11816335203d5113fe6fd42fed672909247aaa190cd4c9ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7c1b1c25023878aaed87af1052b660c
SHA1ecc2d7f7c80df9e76a7eacaaee03f168a5f6b0cc
SHA2563f3439eaf187ba45917d8a42f2fee1632976286a69976687c5869a907c2ea38b
SHA5121a0da4bb129be5931a16f2474e89cf837707b07040cf5853620598fea033e8dc0cc3f48b5b082cee89149e0e3a663d66c493b841226d542249d3521b1eedcc08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531745d7b7f6ca58a7aaa324af6914bfb
SHA19d499605c3bb376889cbd811a953a169da2c8c01
SHA256c2b2f6f84feb83b53816d3ca868581c351bb63f9f10ab0e5005009882c9d6d3d
SHA5125d5bcae4457e2657f1810335c14df8f84d32fd9cd2e4237d73668a0121dcdf894cbcfcb725b5fadcb8642cfd32cb2128c8e05ccca8d5bfce873463ee7d0a273e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58297e225f77a3a97735f9cfe9005215e
SHA13de2ab354100de5fef49ddd7c9d90171b751e829
SHA25643a32eb99921b73b95672db8e3e2fe2265f5d9288a4c285b7524284f46b56db1
SHA51287625e1287eb19a3db68d7f1e96916cd38571af9eb00044891a367816e90b6dc3b0d92be8fcbbeb66d0dea14b4a0e5f71681a89616d8880a3e9a2ea2cf64d4f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4816b78e7c6429e352f0250add19032
SHA1dbb1977c90b4daa99ece64e3b8331807969d9441
SHA256407b930738e0f3f3b5db89e807d0ab5079bf9320b492b24d3451475c48f399f7
SHA512c171df4537c3a7a9b21684e5b262587e17bf74debaa4eb4d96b57f63fdf50093b0377ac52ff9b0fd95428647c07aa2f1a4395b12afd08a834ffe7402a9722a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba5dd0d4b31881cd9ab49dfcb8a6f70b
SHA161ef9f7180c24d5e65de107083ac8c72268804e0
SHA256bde67986ff807863d1e55d4a4d219980a1c927493cc20819d2ccdb432348022b
SHA512e47303da36f5ecf1fca2c246c76180cf991208c9c67d380364ca7dffa7145a439a5a296744ed6e78573c7f5f57383fa64fded32698a6c68da28d199ce1790ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5334e40201834bf17bc6c9f418070e4e4
SHA1fc20ecf8fa54461067c31f86b12e171a56bca292
SHA256e61bd3ced4826da7582bc6648df3af5e5510b729f1ab836d6b05217624c8883f
SHA5120ff4b4fce171d66057f8413622c47e015a6c54704432fc9802d984114dd8d1ecb8bd731d1e917f76e9d87dc0c9867d97044be82c9a25e2c9f3604ae49fda05b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507a0ffdfb777da17ca4b1363e9d11a4f
SHA1ec775a5be3bfca6825e4268efb6f8e56a71e7091
SHA2565a7eda93bae6594302773681a67cd8f78511c2acf4eeefee5fc95e572a0b9e76
SHA512c780b864406737b1418a427ddf530fe57edba293485599d263fded83758821a5318b32185e20b2701430da6469f9c306ed4a10f992f22254d8ed2d2d56c9049b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573e8c6b46ccf9dd244ab14abe5a2f99b
SHA1a1f3fde3c9fb138296123b137f2b0fc7835c8efe
SHA2564e43f8d6db430c8007076d78ffde8ee95937a3919d68ea62626d8586b3a52afe
SHA512bb27b097248e62804c4dc079ec8a1fa068b981a91d7fac6a8cfd2a665f99246f113a08d7240f74603442ed7dbd194899718f640c30fc4b423cfa7d456ecdbd1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546c54c3a1403d763639f18dfaaf6ac83
SHA192ba0c54380709a706fe1fab06ac002300de44b1
SHA256fbb3ae1b2dbbe334b7fe979d227dd39c56c4ebd56cd0b54f5f0f425c1836fe3c
SHA512a82ad6bd1dc2291356b40736bc0c964c4065d1a1f1c1355f0a596eaf5ccf77fd200fb4dcf05c810fc0b9a06b594e711997f1b8b8eb19f2e202cb41d05e75d4c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff69682e4453fa11e02a4e1e391d35c2
SHA108ecf7b567596a9867b0a20414acdd514768db95
SHA256d7df46d44935870897dae5558d1291f5cf6c981375db1b664801673709f84cce
SHA512ea4d9492d11c42648eed9523cf0e90491939892444c18095de5dc43c90f2db65a83571ff5025ecd2fe5a9b4b23f90f266c8a81f7b4815d654517d119a385fe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fffd3b9053ffba7664b19960052d4b76
SHA1b04cd73fc72ad529740ce1b3f39bc0594cd78f39
SHA2562724727944ba8fc4e3a19d8eb44933f379c92d51efe0265e935921009ac41561
SHA51224a8253ec4ce2f933933cc61bc64da90366f7fc1339f28970dc27799b1b11f67983a315bde44ef55dcf3ada29ed1663f544f393348125489d0a31d941c388932
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fb2e7f857483a46d9c5eaf644679571
SHA167b2100dba35c80c78fa2e1d4ca7f9e640ebcf67
SHA2562eb914355ca2471f73c125a003b9283f9405e4665a9b7771841f58d9a8658082
SHA512e961db79d3397fd959c76dabaf89b6559071755561f0dd7b7317d1aae56d005fbfd4b39f032b3a0f3c8d5b4c275e987748c988b1a9e52ab6b61b437b24b7538d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be97905b5a1b06209f959bb7a435fbb3
SHA1ed39e91be4c8822a973703b13ce7511806d394ed
SHA256546c23656d716ec13adf80bd5fcbd69415a6fa82717e257dd0f9cdf12ef4148e
SHA512697e6cba205cc686c320329a8072a2cc7982597681d8a20fe28f3075d25af80df4f4e27b3ce6f098378412dd43531aa542b2c19f9bac0b27a5f26c7636f5a081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d92f4077e047eaeb2f44c377fe989c3
SHA1948513db7e602de95716f5047a15d19ea15375c2
SHA25682d242c21be041b5b64cdf6fb3167cf5a5369e546f5e26462cb6ddd9cbf939db
SHA51265d40fc84343fe32db26ae0f290a8719993b798a9fb3782859aabaa2faac774ef031daba8233a1c053165078b7aa70b3371a93f43d337f0502990fd033fd00f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55df14c14271a5c92f2c8c703f44cb50c
SHA1fe78adf2bb4fc11ed044f117471db52d3cb55cf9
SHA256bb070217809b6e3926f9214e9fb9832c75c72a8fcb1ef952c700424ccad43bc4
SHA512d1729953749ae46c982d2e405c2bae52ef434c51efa6b4ad693df9686012f0a078e2bab5341009d11ab62820b9e037bf73b72fc53db7ff84fee606968bd52d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de581f26d026e44d10db341a356eba0e
SHA1f978e54a3f942631a4f296a5d3c2914196bf1343
SHA256f4273f1de964fb3836072e48b32aa5105c3e91527a7509afbe3c0551347b92cc
SHA5125c620c976489669c00df198fdc663ae2a08eb193b29fad77694e38faae42496cce03e739814d2eab0292407d411d2c7ec4d45f95199668e0eb2acc77ad805e12
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a