Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
-
Size
2KB
-
MD5
4d5116f59259ee3e0c00cca4a7c734c5
-
SHA1
4328db2eb90496676e7d6ef656ba457e00075e3f
-
SHA256
afcfb8035a4723da19d5ae275a41fe6641b01b24f94b37c11b24aa1107146014
-
SHA512
46250191516cd1f44a241477bd99bd1857e59fc223a27ca03499cf6e9d3516e5631a90fb6c1e5e67465d539b81622c18c0e05821cf5a5877fa89837fb4e046c1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0993a3be0a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66A72541-13D3-11EF-BE4D-CE57F181EBEB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000077a5a34628ff077b6944967c8fca7d7d020359a96f1a1191d375122adaf56d8f000000000e80000000020000200000008e772d4547dbdb3a1807a170a57fc2bf816b167796ffdf6336b2dbd9fd1e312290000000d59c9ccf7b0dc4e49ec569eb6178ba942f6e30235eab5423e0f5555c08d383a92ff5eabaf4f8ae1acebed33389c6887111ba783dd32caa44776ecbc9b04885d58ada32f5ffabccea5a9a7eb36077f301a723aef05b5e03f6d55af2f21498fb9bbb8630215e7aba604df2fde5c5e3ba9a883034db6dc2debf2f6d6b7e919bfef739d277ab49e657606bca6cf5ccea7d7540000000065fd7c22477d88d4d38beeaf23494f8438d8a2a9b773054c9ef185ccb4711763755fd6ac149d8cb873bacf6aaf0d13a70f2955dbf09d50f47b8d84e73c3b618 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422060282" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000027573110fd212e81199eb51040bfa1ef0eda8e11ba504a0720c44292a66ee29000000000e8000000002000020000000ce5f6ac589ca323d7359b44334b4fac5f9796c3091ccdaf625891849dca49b2020000000f794e5a55a05c990b5dccaecd49254fffc964c43321d56c2ef968ab635cc7d1e40000000a02926552a4c43479ba172003e0386ea3d941d189d209a59c81d15a4a16dac6989bf736868f1e6f20077a469bcd83fd69c6a66bcf9a5a33b7b83ddfeac063746 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28 PID 2036 wrote to memory of 1764 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c245a49bb9e4ccc23f3dba6554a978c7
SHA1a1db359af2b005146eb5f7ea81e5b4a8cb2def77
SHA256e5509d615b15aa7f68151838d6b78aab4f9b1a6d28d9e0ee8dfefe162e7d01bf
SHA5126539d93752a6aa3717ec5205c21a0ea17402e47a4db5a2c3230614b944645223c02715d9e1ebaa834ae953a95a8229d7e3adb769a96cb3eeb0e13ed463e38223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cbd43fe5245595e8a06f29682447e59
SHA14d4f4a7b133004c4b00a7474bf3b9193f7d89b47
SHA256473f953d6ce9f1c426100a4f35ef781f1a69ec5ea4e2041b60e00b7d25820694
SHA51201e1d57b7ddb27d13c3fff4ce966ecd3168e2d9ef7095ae4b4e9f830ba0e7c827803ba56e144d7ec6407855a4dd9f4720743a8c49d3f09aa302fdd8d317930f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539af1e57c1b87850328b32f428489a15
SHA1510341ca6591154d6aa5cef80ce5c00a7897bd5b
SHA256ec83a7babc77c07628203e12cf5eadf851bd225a32aba5c3cd08d0c8a3c7f8a5
SHA512a364a8c6a903ac884c96d10e17d04e36e242a0f02cf11d931677c91ec0ad7676bb21611c0316783872b3b00ebcaab7dab04247eb9554e0031a4667132848b94e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b16427850c0b508e29f09dead8e58984
SHA1d895210d78a492b8edb4be261a06c696196e3647
SHA256dfa6049f6297d18b321ffd27476c0831e90ff4cbb03e38dce0a5ecf848a57305
SHA512054227deeb624db1f8369a0f5e1a31c7abd620ce8dd9a07870825ce3e63da686215e40c743d4c844b30818011119cb07eaa8e39b3c12d4a47c717fe23eef42a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb01a5bb079270e19bb19e4e0224311a
SHA121d5e0771058c2d044b6ff8ef7148a31095e4d06
SHA25626aa30e2db3561ef8f9bdb0b4f47fdf5ee64f15079664a9394752094ada26f9d
SHA51234d92b5a2e7809059116c46874d09e83f98d82d785db0aeb7b7ec1c3dcd9a2c166f336462673b145528ba55362109d57558667b93a90aeb4c24813c6ee3ca5e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a59812dc4f5c6445845660515eb91726
SHA1aa52cca5db33ba9f5cab714bd39553ec1a78162a
SHA256c4af186e2aadb8ccde984d79d2783d2a89d0407563fc08a23a8d1ec5da648d8c
SHA5129bf96f559e9e410d25a93edc9c30d715ff10b3b32b73c0331454489b35098d318c14d17cd51f7e32b01f91c6e0e72f7d5b41ed6e525bf6f3827610ca2b614675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575498521a58233711d2a6d35a915eea0
SHA1d237a5a23f9745b2823fc0b70dacc10840dd2b51
SHA2560a0d563cee566a0b676f24710e2ad36ba5f709c06045f59aa4f7c1472bfe68bc
SHA512f1695e9ddaa9063d69a0d46e3da3684a8487d68e1c6a9821c96f4589be7345a6bf3409f6d4f864375c9020495dd72397aec06658a9b928b5c5c47a6d50bcd748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533c574e667af4076ffbc553e67e941ba
SHA1332e6be2f57b88bef32c70d4ac43a491ae60c17d
SHA256815ba29588c9c4f8e690d6afe58c717f8583c7c283e2081c7b3a18d1ccee65d6
SHA5122f5c543775a07b46dd960d61ecca3fc64a06fa681e001ab79e18c58328830b31fef74410834d666afd5481ceb618ecc3e9e41aab25b1d5e3cb47459a4505b45d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b00f60c61f769bb5c1b3d8e03ab1fa9
SHA10882a4ef8252c6be65290757ed3d142d53f8ccb8
SHA2567c1a8b3e7ed8701c09953f592e02a92daff061bd596a5cc8cbfb962e7d7362b2
SHA512fbb50033d33001871aa36790d0aef34cd6c972f93dc42d7afa0b5a8651fa5d6a1a7d409e98ab88b26b637d672e8f50dc2b4053f37dee22d949948b6e840d1180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570b7dcade0756483d93adc6edda12b5f
SHA16de3a301d76ff9b580eba1942ff94fd2551441d8
SHA256e16b400a0256afd735826f46502413d1e7adf87341cb3b18174651beac168b5f
SHA5120559b72c70596e1b1ec27ca0a1af063735a2e08d036fc7cbf6f057411429bb89bca4840e8c2dc20fff7112cd3089368ad611dc465325f44d61e9d34181ab6767
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec7e65e82f6718f6539ab54745a90de0
SHA145b2837695e92f5fea76ea3c28fabc5f6b6e1e50
SHA256cf2d9562eee99b32ca398e786b77c867233f6cc1392ee6fc97494326579b37f3
SHA512ca2fe03405410b164cb040a8d4bb1167c6c090dbbcf41ebb07605ef7cb59c82589733147b6fe54bb787f672805ddd962f5a073f424ae6492c263ac03b741e6bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e3e874dff9fcf6f18cf160778366ea5
SHA1687d90e07a2e580211ac40838ecf8281f62242e1
SHA256c2b83ee18ec95da975952e18eeebc51c218dc8d8651d998399af75bd0c187b29
SHA512626fbd9d56d1108dacad6edb10d165a634635b25a4b3c82762bf2d53f87fd8325f140a86d863418e8456830bc6a446c13a6d0b33ae7dc86f24856e927437d933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588cca7d453b2991aa3462900dd9dd2fc
SHA1581e7a60e320c7adddc2863db242672bb39763fc
SHA25652dcfb2f6efe386fabb42edc757aa4ef1a0484c5da582d15ba872241ca174a83
SHA5128d70ccc4c92976a63630bc340a41522ce6c39848848185c7eea8e9333d75c1588cb6e800026a4f62b39c19c9aad7fc4a34d589a59db05b4b80971570f412d96e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccef12dc220b8683e100af8aa94f0405
SHA136fdbc3a9c6dcb46b0a728521f54326f7ade0ec7
SHA25688ed9d20555e1aecd3407de2c024183f22a8d0d95349ca4e10ccd2a2653c4e20
SHA512a9b57a1ae1ec6a362a0861c2af3111287e117bf798e710bd2d2fb188a462fc1dde69177aa1eb0d15a23a238d8953f5b353a2962075646598c6dda4824a1005ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c3b7f076a25ffb1a7c12b5873d09498
SHA183a0b8d7a8c9269f18b2bc28fc8a6dc57414d0a7
SHA256f3df049db8b74bb265e10e764f37b73aa812d37a4ffa77b8735e3f737f795457
SHA512d277e01bc475c5f2bbe34907c46cd91986641678d97d4e0b7f680d501638cb974fab0d292e0e5f790a119a77a4e95f1b81a560b2152b64035c4ca09e7e551fad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533f5cc830604f2f8c67020e2a45ed802
SHA14100f12f896d4bef96e99611d005a8995c3ad7ed
SHA256c8cbbf1d043561fe47b594f52ff653cc012bfd4f58285164e612151c9a59188d
SHA5127b20c5914d0179ed8429ecc021617ece7be2422bbb63863522158ec38cf39ef81eade52fc131fa7c917042fb71270ace782144f1151cb48898f1890e1e6e5bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e865355a8b2e6d142c9d8d0a55828e7
SHA1843e03bb33593d028d26c0a843e131767aac1426
SHA256c5f0493856b6f2a5ba30bc6d924d4fe6dc1971d610ec751d6040d914e9325bde
SHA5121012b6094c3ef0a48e04be622b6e5fd279c99c9d643b0c53d559695ddea9cea0ebaca96b8a36f4c4172a59fb01da73e43508b86e29455cf6de9aa664f60d9b71
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a