Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
30f26cb2ad1369d580e3aeea78b975fa_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30f26cb2ad1369d580e3aeea78b975fa_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
30f26cb2ad1369d580e3aeea78b975fa_JaffaCakes118.html
-
Size
24KB
-
MD5
30f26cb2ad1369d580e3aeea78b975fa
-
SHA1
0775a30d0fe95adcdfd0816ae506462e7d7d7c39
-
SHA256
16cff885d0eee895febe8f8a6a7ed4b607d20a780ede590b0d467e633a7644ba
-
SHA512
d7296b5a332939f7ebe64eeecc2eeeeef14659a35940a8cdcb7e8173f7e939555faf85557d2c62cdf804d09ccbdd4910e40e969703ff63af92f350e39f01e577
-
SSDEEP
768:oCGCGCBCBCBCFCFCFCtCtCtCZCZCZCSCSCSCFH4:obb222UUUQQQkkkllleH4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CD05EC1-0F0D-11EF-8962-7678A7DAE141} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421535314" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bc253ca4559e975edab65b712dc25c7a76aa65eb0122428afc0595fcc0c14d32000000000e80000000020000200000002b5a3e0669ff3482e7b6e09436fc1e71166911e56cc755579eca93f2540f2794200000009834ac150d9d1f88a258e4224e3fcd8c69f0149e58ce4f56bcf25d2f800b62f0400000000e017434dba709560152608ef9b45a52bc36f64661ac876697b4b34a1b46d755c6a95b81f913fd42756373b1b57baf85b628d4eda61da6744072d3c5c3e69855 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000035c40a04f7a1d2c7271664fd7f640986cf863cf455e2eedfdbf69a3998172752000000000e800000000200002000000041e42b3c10333256482490f5ba9e0d8a4a74589ea62456008328e131ba10ebd490000000ec24b93e015df0f8cef952f596c19daf6e3b2aed55d7f0e91fc634f32ad46a557ea701750d589756b85bc1e99b523655dc0f9ee353b42f5058411222b412e0630e4f65aeaa999373d2592d1c1668da2060ae1b8030f957bba3d414028c6c1af5e05128e605bb12ef3ef533c18e6b9a7cf1b4648aa361a7c82eee15d015a51916ac3fd215177c2ee62a986769dc5dc7174000000094129e6b3a8c53079c089f8479a569607dcab86dcf5b1d26129a22d66e9351ba1c2180e3cd40b17d08ff48a631819226abee75e5ea971a8c993922aca78b5a3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5076cdfa19a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2580 2036 iexplore.exe 28 PID 2036 wrote to memory of 2580 2036 iexplore.exe 28 PID 2036 wrote to memory of 2580 2036 iexplore.exe 28 PID 2036 wrote to memory of 2580 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30f26cb2ad1369d580e3aeea78b975fa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576bc3f979b4a7e15b0301af4ddfd3ba3
SHA1893a12e54e91ad547b0fec1c4365af1613e58227
SHA25660efd816f6cefc1321b873a7236ed5307474296f23449f9c436e332eebbce79a
SHA51280fe5f44fcf80dc1cd05d2b1c490c2ae0f95e2c672eb2aedc17c8f179d3858e81ebfc3cd4f915aea16f4f3880ea781f4feff383e99bcce4aa3a8ef5ece05909d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787bff44ad27b29f234caada7cdc1e0a
SHA1446c7ec3d0716255fbaf729db52cb68b242fcf66
SHA25605d339a135d39671784622f2b4af584dbc6fd83db2c3abbd07b4d390dd0c279b
SHA512d41dee8efd5a715bd1e48d8fb5c014395d50f73c2791c600f4ac6bd89936b92593cbd9d361c888785c52e7ce83316be8465987cf9fd3935944cc8a17e4f974be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537c282d625c47de74d0cd160d194b22c
SHA162954bdb6e3d6daa67120f3bb2a50237493861f0
SHA2564382ffc087251254ef312af0cc64d4ffdfcf57a2f8fb8ab773793eb0b1822dbb
SHA5121acabd40632f9cfa88d8ea7901d3424ec8404710dd98aa16dba3ac62b1337f2e4b4a129cf091b17eb93592e65e7c846bbe645177b472dd057d5a93e61b4c72cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5846a648be74a38542928474ea5d53312
SHA13a886b785ff146a1f79d5b85862e8f37b86e53aa
SHA2563da4757129064d7af77aa56dbef2ba1a7d1bca8f6cf60f0a763def845da24477
SHA512ce8a053f816341a38bc40691cd2564f252057791d91d6b2367e1597dcc399b06bfe149c4c491bbe6f001c7df7fbb061be3cdf7d6dd202120f943533c267430d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515abe36f2b5edc64a26fc0a63fdb5173
SHA12c853083924a1ae9d3b57d9c11803ee0c1ef8307
SHA256df8c17f1838a29f46add1cf7aecc9b3fb9e7b579d175e5af1f3c31210ddd372e
SHA5127662a7cb147732f5d29d884d85182995a65d918e7f344ff567234677ed423a877a711004e96023712752f191e7911b47568fc8fe5b685a96723237dc4341277d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fb262ad1afd5eb0c162223d762c5317
SHA1cf7da1d4aaf3e2c3f035cf9cd58498618235b3bc
SHA256a38a3fdcb89160bf4c61ab9e1a43c6ecb89bb47b6cb46a56cbc2f49e3d645781
SHA5125377a1c44befbd7aa38ad7b38a1083eb1401283966432f742058e40786452a9afd65f664dec7594bbb282c99084bf620d5376359b0af728cfb14842a25f0922b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504e259bd4db256e31cc90d3929460af8
SHA1318589aff0be3ba27bb2e0859ce04cef3395bc12
SHA256f74ebe864b09c9ad9989e601669aab882144b0bbef6c3e152ab886cbf60f48bc
SHA512424459efda1816d25c18ab7d46c5e775cee6f32eeb99a60439f3ffc57153ffdfea65a81306e84e94893c1eb86fbc7804d3e20f1ae26b4e8c8688dca8518c6b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56427101613f3065696dc9ca011ba54f2
SHA168a13bfc21aedcffbc90900dd0b066c2428d1759
SHA256617bf069fcd71d35d76d181178e9b898094d984003de3de91a2a014004c953b5
SHA5128dc45b9dc053793be152212dbe19bf82973976207706651be67430a22e2934f359d6d2895fd0d542bf5c3787345cd5215d48f44acab825559a104e4a649e33ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59599c1b23cd82eade877fecd543553d9
SHA13d6f7adfc3e31e6347854167ff92b3564f25b2d7
SHA25661b5572089d9b51d44ee2180c1b4cddf24e955296ae402c56df4fda8f5512636
SHA512540da2e7fa5023cf81c21d50c4fd166a8083326f91d895d68c124437cf3be3055427a6c4ad67826d3be1bd86cfeb13eec77f0876def6258dcd43521dffce5871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca1c3cb690f5de4b255e8a14b2e1af2
SHA1973d5ed694b1a6b9a5943a7d3b5e58a97d365340
SHA256a22e9410e1c8e2e6434e44a69b07da9c9753b80ebd0328fd4afd1b6d373f40fb
SHA5128b9c357068849549a3b7b45f6f2df35e9e42399f625b4b09c9047c8405de91b28d9c74e9a6ec6ac1d9250db9e47d108dc969adf2d81c99fb9b15b8bd05372c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3b809acdb05d682d0c709b7fd42634e
SHA1ff8ed96d7277c9adcbc3cc2d79d0fabbada8233a
SHA25612c073e733a10ec3abbcef1e7531429092f552c1494af0131fec3566086110f0
SHA512b8d111a456088c991ab32c23cb9e8e872187da2c46d5a69ad17e6fde95a4eb9b5bf84f5390dea8e8ef40001c050e8765d715df6137e85d676eea31b6dc3b37e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c282f38fe8b1f71af39cac43ff21fba1
SHA157c811b071e0fd81274cc6d66683c3f779789e66
SHA25620e9df07e4226202521009ba0701e569135857b19d1ed489d5c0d92cade4776d
SHA51203d62dbf0301a8aadcd46a55c59ae1688009a15bc9f5c023f0acc98001356806020b2818bbc120a1f76240c6e844837d9bd6a252a79c4989905e6235d11094a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfe49b15d58c119166cfa8f074b3918f
SHA155bee74e91940cfd95c404dec6fbb2c5e18efffa
SHA25608d0184b0f58f697ca68c89e1a193260891caa24d0ba054fd90c20d968032ed6
SHA512f300f08890f0e28453721d552a82b2054d9008c7b53e377969627f90f579ffdc1ad58cdc06d15dcb92454dfd37ee77bddcc830bc5b60814d021a8f748d460c01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8aaeff3459a5ee13e0c2f9a4749dba1
SHA171e293486e723d6898a0c3c310a989c7e9e4377d
SHA256ce2d1d8e5bcf08090429b34dd187980fdb6a1f26beeff5de9679fd4438bc1b0e
SHA5125ddc9a72007e61335162b52fae9928887589c82f2b15bc0cff82b598c20c2fc0b8f7c51fc59b900c7dd71701e1de61da94981a614cb77cc7a7fcbc32e3b102b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5556ee19aac1b70c46abee40f76967e04
SHA11403e5c4d95682eac852bf6212d43ead7b69b3e7
SHA256d44629731537e04219a8a9838a1115ba16bfa80cd081ffa4fe46cb3f7b0796b4
SHA5122ca0d6130b3137a4eeeb0f50e2a45862369feb2137a85b10d9ab68133ffa98932f4d61469f3ee0c5ccae38386aaafbccdadc08a4702feb4325bd7704ac3b50c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528b3d2974058de37ad74591b5d9066aa
SHA13a356c8e69c3a79cb80aed8007abd95517359b91
SHA256294dd1ca3a3ac25ae0c28ca8b141b7da88d27da00142fee836b38bba66c81fb8
SHA5126104d1d6bda25db88292bf41c87a8aab8cfe76f926e06a17f5e130f588b3fbce0be046548a8252dfb734b691f114b23e4f95a113fd740a48d942d70dc42009ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545ceb54a6b1e97e450c89d943b35e15c
SHA1957f0ebc13cb706cca7cf6b62e2f5657fa35dd40
SHA256de8ad3c45552aa0552ce14742d4ca7cb1318323aae02e89359104390fb74a1a6
SHA512a61d2fe3b420ceb3d9c868b05cb5faf9615975f09024d49bf04fbd245d7e67c1de422f6e6e312028732bea30220fdd23dc5338c4210730cb3e81cae7b7470afe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5859340143c77d1c6a5a3d7b19f773513
SHA11262f651e4e92586dabadadae3d2a6310db7db52
SHA25656a8b3f9621c4be4f0c26036e6072066b727381c9763c01b8a0569d40412af8b
SHA51290175de77a9d25684da52c373635df4a1393f525ec0a259c554b143e0cb9c9dbaa17007890238d16daefeeeb27dfc8d1cf7a012ddde1bfab007f0ab38888419d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534c95a6dd1bf2cf4af19d0f1eb9ca322
SHA134ca7b16623baaded59729631b960470bb84c929
SHA256af9e0e11eacf99fbba25358df88eb6ea9c8187bc0a52e8772c22324c7d70f705
SHA512ca7f6ef64e568e65fda1f87c61727ac0c7967089e31fa8c2a150636a06acfbee44fccd937c0f9de5467c4a1fb1ab7ad696c919bbbb262ce6629623ad7eed42dd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a