Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
34d5f0e23b2578767a56d05c6be238e3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
34d5f0e23b2578767a56d05c6be238e3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
34d5f0e23b2578767a56d05c6be238e3_JaffaCakes118.html
-
Size
723B
-
MD5
34d5f0e23b2578767a56d05c6be238e3
-
SHA1
fd8dd5a4010a9bfd015c60969bc61a0dab5b2839
-
SHA256
abc763da8e5c2269a996feb4433c041a977ef8fd036e7f9658784cfbe66fecf7
-
SHA512
e9def2e8dc20453d8f4f0ae81654469c6cd97ab75d8012a92b51d8b92c4dd5c016a980e3bf7279b3ff8af02af6845f0efe9233864e5f81503b6313bee478b456
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421596422" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6492F1D1-0F9B-11EF-8B04-EAF6CDD7B231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b302f0bc1e637f3cbb6ce0c5ec45a990323864bb38b8b8cc25579f3c71a2bda9000000000e8000000002000020000000037959040f82743474ebe9e0c5e5e64f061fad8eb8aa8dd99b51df7c6901e6ae2000000077d168ee9383851b78bf4a861ea6cb57f3a1ecde66d46f0d52b1dadf4e68617640000000b8f941d936ce3954a97e613d35bb62482baa28e88e7074aa70164614fe43684a2fd12cdb45fb0d21b89052387ebb93dcc4da68193d17ab3ca838068a2ac552a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0031528a8a3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000076735fba9cceb3376f6e45fa16ca866894c77019eee6d0471a966f1f3b1c89fa000000000e8000000002000020000000be51a0e6408f5d9baedd41432469b271a707467b3d5952fa21e8631ce3b3df469000000019e875d87992f9af966582a57ab8ec319c17d8124138b18685146d0bc3731c42f58e443d0ff043dd9eb0ab57b48d056e7fd304f77c629cc83a576cd9567dc89323eaf6ebe524c8d5e3e5bdf97a8df48ba7779442950d52f5288b8eb0ae94c64a6d6ccceeabee4db85aeb9263ef76acbe483d92a36edfca81cdeae99488689204450eb4f865b4703bbd19888e072112a8400000009808cbcfe39d16914014d94ff7667bc6ff55a8a337cf3488d2efb8f637a728e67343bfb47f64a5bc4e1f5ca41d99efc23400db03f984db95bed190f129a5478f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2576 2104 iexplore.exe 28 PID 2104 wrote to memory of 2576 2104 iexplore.exe 28 PID 2104 wrote to memory of 2576 2104 iexplore.exe 28 PID 2104 wrote to memory of 2576 2104 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34d5f0e23b2578767a56d05c6be238e3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585c9fd4a039a7ba185e665decb935016
SHA1d2d8bb64cc0d88acfb3c456272df8c6c0ef6ae3d
SHA25617db8df04d6afae144b7b65381b7c5456d263e8f320d266f8adac5aa5087843f
SHA51221f144fe3427cbb13229b95ded3881f7686a7ef696848fe2e6eed609c2436b0b49b639538cecc8b7a91f4523570f92c4aa87e85769271c599990a409df0839c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5930ea6703f083bb6c1516162b46d9d53
SHA11cdf5be03ed0c92079e1de580e8ffe6aedbb4faa
SHA2566953264faf46b472aad91cdd7e53f86ddbd1094e6ca01338df1d92078089cc17
SHA5124f97961115eb752b301766eebac37ab3d3a3d5aa54a0b1d79bb84d0f399af35e255d03a1e4a58baabaefe4d4780a3867d5210afda54d685c8b9a475dccea1655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54928bbf95553816391160722b79db09c
SHA1831a141347120c71619376f6417e10796f2263f6
SHA256ebc5b410b54176103dd00beda414f6c3e49aedbf0ed5eae0d07a06947b547ff2
SHA512ee380be6cbc95775ae84a30f1768197ffe2113fa7f3fe7d52cb7e7594d97af67b0bd12a1d32fc02d8bdc4196b054b72e42f9ed04f2ec083214d6ba5e08c1bf65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5864a3a258b1a00d21c5c14547106bf71
SHA1337d4e8cb8c71962e5ca7fea35f3171d544c7258
SHA256c7c161d678f52997928adf45d7374a29c30c1a89ec67dc149f9bdd6d4dbf2930
SHA5128a579425a7d74534d3dd9cecf304e86d389fe626a7591c4e4c1889ab744de8ca7416befb38d37eb26cd85eae178cfeb2636f36bb2c6435d70ad97abddb6ed4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4746b2771a285d074dd1ab5df1186fa
SHA100c604e1268714076a838e99bdcb8b14cc924a0d
SHA256a16dce1ef39ab7d3dadf543c0346cef6d2df0adaacb712b492fc995b38f2f518
SHA512c6af5c742b812c56f60f842aa0488cce6881a095b3521641ff0f8f3040ca857b899b68fdbdc028adf0d12e92df0f99f3b1244cd2433dc7fff954629424a8917f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f51b5a31f88de0e5a713cb70b2a538
SHA164b4d4c9f624062a945916d52c044eb88cfa633b
SHA256717f82b96c09f65b66999ebd2e09e8324b981814d31c865629a3082f5f37b8f1
SHA512ac9a5d2dbab366b9bc22e26c15b4f063483e3d0625775ea396a026644e5c9ead45c9ae1d5778e51b7d00658751a0a39dab4f6443c26dafbb15aecc09c697572b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c44637dd027d351f4a4d4710ff70fb4
SHA16b9e6347775470b3607f2db7d9e5436cab9a768e
SHA25636ff240c8fd617620902af9d7b172ac82af129a300be0f71f1f571f9ec2a900e
SHA5122c2b88daf96018fc56e588f995e94f7fe9c69a8b7810b8b4fceb0fa4e6c67b64b0e4606219ede880e9799866a7ed270d17ba050b4aacc14fc0a8331536f3a8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dde5f7471138a2cb698cd1f472ce7a57
SHA1273f0db5694a96fa2ae7dc248af95175362f22e4
SHA25645766215f5113c38355e5144eba75b32010d41e4a415285c2a4f60949a19c681
SHA512ae4ebdd3f96e80182ae4fc3c750817c6599f7aec774c68451dd9fb6a9282ec2cc6636f4ded3a605bd15ff5ea56f3dd93a9487106f700e93be825fbbe9dfeba2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534b92e7ccc40cd89170a496ea51a6396
SHA14e38440fde93e704da1c6286397057082e8f4cbb
SHA256203ccc22399b007b2814da5958b2f072058fde77b7d39727fc48889776362175
SHA5125a6451233520ed2bbc9d880df8011c29761af5279bc6f81bd93507eee63244e2656e06fa970d2fca960938c5667449cadb2f821c6efd3efbec860e0f28a1f287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2980f5d28fef559d60315cea6ba3031
SHA14ba0d17ad24f9add589160f5f1a30352dcdbd1d4
SHA25603bfa101d6c2cdcf17f858aa84ce38e953b8c5c9ec3f82b07f22f7fb293e57b5
SHA51224dbb5ceb2c288bb0cb951d99739dcba38d81a47b3134aa897ce385b1e4a75ed3d91d8cf79de4100e012057b2d10d089abbf2213672f8055971f3baa6c9c504a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5562fac2919255c135f4135e8a0f9bc7e
SHA1846ce9a67f9465a97d714a5005c98137a3c5a94c
SHA25666a4bb1d6ae27a5675a0bfdacb8b8849641efa47ac628d244fb07304ce0971e3
SHA512068bb63619e27f63023757b243c728fc0d871a91d0ee37ed64def133649fff602bee6959377d8b343caf114bf31b1865551ad16d41d84a6bd096ff4bc2408eba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57937923e375b9811c699b662158f14c2
SHA1ad04206ada6158c00cabb82831981e5e78ca7f65
SHA256fce6dcbf3c19db8ab384ba07d0bcad487671fbd20b67b11c7a6f1249996834c9
SHA5123eb2ac53e38aff24ebc28deeef406b866779527478f2bf4a0695c0960d01796ece6746c28cf1e5fc726924f69cc591028ef0e18041349f4160309f35aa1ca9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51728a26f186ba4f7145e172fa59fd3af
SHA136518029b018ba5f6ee9bb095a59328392ba4be9
SHA256d9e542659d476e24286368dbec89eaac0f1811e24af008dfd070908b8f01d896
SHA51208b84e3cc0f9bceca4f2b36dc3d6cb84c5738c7bc6094d2b2c22e9d49b56dea8395291bd2bdbb50cf489b0f5ba1d23e6b56a3f9a13e8b0656e5766e605af355e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fda49639dfc8dd5caf1ed119751d998
SHA16e59cd807c7dfebb3f9ae4f2aad4b5d0da616a5f
SHA256b86556028c0638f606f6965ad6a4b6d8eff551bb1a2f34d8d21e0cb8e8a0cbb5
SHA512670b59e4668a0664a3c13c3d02e1bd025961eb6421d8de3f6ae0bf33cadc1bdfb96e0dddac2ffda6fdcb68eddf3a336352109509aa8b205dd7b645e0e730cb1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bca3b31244eaf7de549567271fed2486
SHA117b3121801fc2b81cbed55bfda5274918d865fd7
SHA2566e28aeccd0579eddf8d661b732002d341e0ba43e43927b970d823902a8c5da13
SHA512b9c709d09719710ac7a1b1392b12b1a4d6d89dcf6b690a1f820731e1fe124c320354fac3d9e7119b0b68a6619ef33f31820683c1ff97939cc65bcfb31e6ae873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d33b26e8878ca0125a9aec36e2f3032
SHA1b1af0d933a9be78699be71f34c2cc815c66b8ffe
SHA25645a938fe0c3d7d88eba3a210abd316cc3a3b45b8bdaa2df7aa4a83501961e209
SHA5127d7f4456ca5a6e6f3ad9d988976dbc8b8b6f64e544065f886b05f89c00f9b9d3071f1df6f25ae3e357c50ee6ccce250b0c37b77383059b7f3e618fd5e7952dd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c886b71f689f29dea5876f423588001c
SHA10ea8756de3859a11c7ac3b506c213efc2d817ee0
SHA25694720547479d8b45087faa3743226b3be244996e588b638fa92053e2338074ff
SHA512c04aefba35d587746ba68e465f5c88fcc6e766cd3c0acfc5e0be17a012fad42466b892bd1e537e01e67d0088fd997c49a23b31b6162217de82f17a33b933e27f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553463fb56c040a71a27e6359be3f94fd
SHA16e24b4a66d6dca9d8d232d5401909396a0b55dd6
SHA256b13e0b270cdd67cddc9926387585697185a278a9620cd04e7f11a62b44442654
SHA51263857b376c95264ee2c632f3af02b5bc0ed2415e26f8950f183d53fae8c4feab7169b290c57459fafd736da226cecdc704d042ec5cccaa6a53dd591e7a42dbe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504d84fb88e9ff52a179fbff5ad54c815
SHA189b0d5e9b28acd7f2983775332475365ffd3a49d
SHA25600e3c1f50a24f6b18d2b74571355f8babb9d4a61d71792b98778f57c9cf4f00f
SHA51253ea3bc0327f4cf66cf708f9a22b326d3be9bff6bc9203e67f3a26b8a5ac4fff678af2b0bdb4422bc1d8c2c8cd8365fd99aee4119a1bdac4775ab3c99b213864
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a