Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
2c579ce43c9fea92316302004beba440_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2c579ce43c9fea92316302004beba440_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2c579ce43c9fea92316302004beba440_JaffaCakes118.html
-
Size
72KB
-
MD5
2c579ce43c9fea92316302004beba440
-
SHA1
e11b68df6c1b341e3f3147104f410c650f3b83cc
-
SHA256
c90f163d921631fab03272e5a3adeaf5b8cef433c2287cbfd3fbc41687fe907c
-
SHA512
5e0ae0d3b460c22e695caf4cc30e99367d17f9898fee8eadbde88344c35b940be5ab0bffe12cdb50912f84ff3b61d1437c4ceb8841684ded55fe50f9975591c9
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sE6HKOuCQ4gJoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcc:J3CeTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68788991-0E60-11EF-BA8B-4EB079F7C2BA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f27720854de8288e030e47317c24c6acdfab664e157fd3c24d51e4ed504b1939000000000e8000000002000020000000f0daeab3705ad7d611bdeeb78deb54a07f6e993231124a8433557c8472f9ab9e9000000087a21a3f597120115d085763df871647b515f91596286921be22fd3b027243d633e1d4670ef9d6e3692a9a51157ecd1d08a867995920e42f93f57df4e7e3a1f2087d192ac04644448ab8a960b3d91867630944864379d90b3fac323895bdc625d58319cc409119864980ac8b008251f525d288b830b5e2586168d3c98ef9395e065f21e672d407bd8e9217bbb2701d5c40000000d78123866c445777e455764d3d222a198d811147ffcdcc39c8e7711f7293ff52ababa145f3114a489c161655766345b275db3a57fafe04745b108456a212c709 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000006fc5f9c869496a17e49e0b16c5f9bc44325887adb07e8c58cca2a72c0747f46000000000e80000000020000200000002f6f0a19bfbf8ec559e2cdf52ca9ec055a5797f5ca79bc8f9935a3f8f999bcb4200000004d3c80eb81a11baec3c7a444d2dae64167392cfc09e9a122619835910062347f400000006763c0c2e45c9ab1131c5d90d7757543174a966fb6d72789b217b1ee6c4f267ac351d394976d8567acf95c61e743508e5f2c0f7ab29b32d541adba3983eb4da7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421461137" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208e463d6da2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c579ce43c9fea92316302004beba440_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b8eb15a4c053d692502cca04112c6c2
SHA1c73454f68477ffdbff36e5948e9f4860fc102fa9
SHA2564b953f96a31d76140d607888ba6cc914d20ac6147beec40a6d2c336f7666cd48
SHA51231df2156eca9ac52d3d530a41cad67930dd221dde5935f20818dfe44a9d7c05c78f0b46d19f147fb82b856d057cebfb3d090d5cf1d246c438f14ca444b40ad1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5626ae023e77a2b1f26c08f73ca89c978
SHA153a442b2ca4451cda0c04e727b32ea6ad632ade1
SHA256a48b74fabd238b80c00f0f4fbd89afb47863b449552e276a1901ac462a67cf7f
SHA512dde72ffa794c09cf0a03ff0fa0d84a94a4e3cc9ec0a61e0ce0a29875e3b8292e530de6819991592b3ae21aa3ad6590c3ae4e51c48a419229313e666bd3d03ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551895e109ef51f2359149e0060d170e1
SHA12932d76a55a44e92b6b281236e559f7bc610e210
SHA2564a2a9747052cef227e09052a4bdc7eb24f1fb352a104094bd18fc2b1a5269c53
SHA5125d6b22a89089966d1928e61dc4bdf13711f0c842fa2e6ad6cfaec1cd5249f5b32282a2cc4796acb9ddb676b7a8d85465dcdce81e8cc0d1060b4a98bc3c586379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f962949646dd3270a0c92a03a3c97d20
SHA14e3d50906f97e5998f3cb6ed1a751c7f00835026
SHA2563863b91007b15e7f6a396dffeba70c7805e55410e187c5f4feca20dca6155e38
SHA512d5bcde265c6834d6ce9c0cc39b372c1c680539921bb31c93ed8e73348c542b724e7451191b788e75e6fc418d7f78f73e327332e2eafafaad0ba03ce5d759f3d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5172451787939786ebb06410e38807365
SHA1c5822b7cc3e06a21d0efc16c3e37e92cf8e96395
SHA2569da17e7eeb9a293def028121c359c6593cc3099aa1a4cc9b2c7eb5f06ffdbb52
SHA512b14eeebc460d7916745c5db07108481e2b8b627e2cbe1e4bdf27fa36c2f38c56186b963939e05e4fd79a911fa9e4afe09b06d56d152427926d5fed52ed0a2ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6b5e691466c81e963ec9a4c89c2abb6
SHA15408daaa659c407b1d3d56c1a19e4e377e30a38f
SHA25681e924e968f21b12618bddcf6a41a8575e9973970d08c4e8a140325c29a1a2d2
SHA512efc6db44d0167f5d6a6ce020ac2e5ce5f5f2b6421a2a53285c555ae05df3b60219f860756452d22990cc3c7f3c2c49064bdfce71d00b4bfe473c13655bb79682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b7abbeb2a064243b03c7347dcb9f7f9
SHA14431989ccd2830808d749f11f12fd64263277f44
SHA256416884ace0dc7601df27d9b14fe9e739e15521db49f07b717c29295b07ada7ad
SHA5128bd324d2da6608761eb31a2015bff0db212bc8cd26ab98abf61773d2b8973fe7fa2948038ff8f3e33743e202d690104976bece1c75a4d06104ceb4ac6903b7f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535f31806d7dc02c1ca19efec48f4fe43
SHA15a1d432e6c9a41d6b4bc3696c1fad3a27e5274c4
SHA256cac98707058b78dfb6e79da4cfe9cdb28218690ebac7bcf89a2612e48df6d2dc
SHA51266f7ec9437ed2008fc421477fdf7f9e66ba8af7c4f0e849e896c1ccdfa41ab0e0e134ec7842be2f311397aed20bc885496f4a6c326e16b62f966720d25bceb58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6b75b53415a7890dd71eb4da89760f3
SHA1bb86787f4ef1a9f81558a88ffe29bfd0417b0a27
SHA256524906267ee7216782274ace400403160fb5910ec4f38cdb2bbb959370c34c6d
SHA512fb121660db341a8566dd89048a82bd708261a54ee5cdbf06c3783f4eee6d7c91be29fd939d616a52931db8a69a377cd7aa16a3fb43e5176a7fe522382308ba2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fa8b0172e863eb146f7445121f79416
SHA19cc4335d07f3180e4ff0a1ff37c9cc5498c17d81
SHA25675cadf62e9cda8098d034479ec7adb6c6a345f67c0c7157a50f1f52042ca6301
SHA512aeef122bd8892ae0a8d218c29926772387f943cc2bfb70b5b0aea635dd00e803261e0eddfd2ad3c4379df129fc01385947287e20dcdc2d6461a4b83b6af28753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519b04499b7fce1697f3ba2b9abe7c2a3
SHA1df553fa73e66a206e0d46b5321cbf415308d3f58
SHA2562a596a32026820dcd077bb433fd15d996f7d8053baf418024d71b7d228ea6745
SHA512c9b14b251349d35185ad0f86e5a9beeb867b9afe56de72a03ee1dba9d6f9169ab32f0b75f09cd048cd4ea7c104a8807dd10f1850d0eae6800c2d7126a3f37ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c7e003246691e4c07cfb3a1ecc6f79
SHA144b842568e97a72ee59ced8101f8093591226c20
SHA256e70513750f706934a3ae1e102b5806d530dcf2b4d9ab934ad34957214645421d
SHA512e9ac286d920839b72a4be4e6ba561883ef49c06f0e123a6e91e82cf1ef13dabb6ca08ad40d34eecaf1866fdaef32b304a7bcbd30ebbc860e6c1fc9af8d216e76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cddf6c98d531ffd80ac5ed02cb65a296
SHA1f5ee7de2cf56e5f9e888ee033658c5a118c8d0f9
SHA2568383986aad3acef809820db62371aa0f01072e3dfad360ab5fb3c017177d03fa
SHA512fc35366f7c257997763d7fd6bc5af322f456009632f43ab565a435db532d0ee923edbed152fc84b02a93e9968430b0d92180529dcfad5a1a0933fe0ecc744d89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578b8adf77b1b1d00959f7378046ce21f
SHA1d037de05483a10f4056c8890cc7deea653746683
SHA25655967444faa50224984d409f0a382c6420f8113f067cbb4687f17d6823d8403e
SHA5128a11e008c08d6acbe07a433fc3f993c64d0d5dc25621654a34c4008698855b5b48d574e3385187dc13b1099ec4785be283a980c3498e32874559b8f34178c404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50809ae60633643289851630ba5211d2f
SHA1b38ce359109650ce881542a304c6a782acd0df73
SHA256caac33dd5b99597d8581ca445d3a139ec9884a2f70836861c3996e7e59bd5a7a
SHA5128295f754d64771d1c9dd72af659dd174446f606073dbdc1a17c8cbbffa7b26bca20dc31624cf820dda76e47c765fcbfbee9a77430297a7fd4f83c7062c7e0ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f91c41f1d158a0957360b59d117a67
SHA1dc342334a9e56c58ebf6132da555dbada1d1c2dc
SHA25638ca3214f05c930fd9b9a2d6d62bdc9ff6b66db95daed99d2f02ffbcce36bd3e
SHA512e40df3adb9e03d630f860601f7989323a5bfc8bc5930c8c55fb33b3ddfc604cb5caad8068ce365ba7d62f107be5d8694d2ce6997297e0cc467668d5372867924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a27899d73bdc7800528b868ec391ad3
SHA1b13c550ee2d3e6dc443982b2ded4267f0c4b6810
SHA256209dbefd2bba37857982e07c0d03a2087fcc4c9c49f3e4f35f3520cab90aeed7
SHA512345a8ab1554a09901dae3209d180a05565d4ec709b16922de0a7fd620754047f22a0837fd6efd1133900d17b9ca0406879b0b926b962de936a334bc78aca825d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58586950e3dd3fd7ef34c356c76dbc4c1
SHA15edc459c2289dfbd3199d6d91a253c4302b54924
SHA256bae0678bcc9248e600b9462c430808b5212ba9fe7176f80b79f7c4460c67faa7
SHA512d642dfad979cd4ce31f38e014bf0bc52adb9c608b64209078b769906b91b0018ad77027d2f54bec7d1b469cbe205e0f7bc7f534b134ef71f9277883f518fb41c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a