Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
4f5d40a9de3225370c5456fa6ccf0364_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f5d40a9de3225370c5456fa6ccf0364_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4f5d40a9de3225370c5456fa6ccf0364_JaffaCakes118.html
-
Size
496B
-
MD5
4f5d40a9de3225370c5456fa6ccf0364
-
SHA1
586d8997cca617730827bfc195edc6564d94c244
-
SHA256
34b64cc0556a5c5e5ab10921992844f58068d9fb00845594ee85ea6f718c835f
-
SHA512
79a2da33f888851c178e4f8f6f04789ce1daa139bca8ef9b82ca4fd8a3ebdddb5a3d5155868fbd99985831626866dc7a4abcf790d9c341e2a7ca0116ddafaef0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8061eb523da8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000041573174f7a5789246257aee05bd9c80c32a1297528670829bb469fd49547b37000000000e8000000002000020000000cbf30ede52c38ff8412c28a6ebd809302ae3a798d83f5b22444bb773241870429000000087860ab95b4f27d436658bbb87ff1ce3417ef68db8a1deee4db54ef9c9d1c0ec1fc63c6c7ab526fa62241baef5ebdc447c41accb830c50c1c260b637c7bdc97e52427564014b3a2dffc4be6522197f347f9637d89c5a4fb3cd2279d045d3aa5bf2ea2918100322e3d6db974cb222bb173ec8734ebb0f77192687eaf5dcd6b91c611aefbf39c20ffb3a3ad92f1111fa6d40000000cc9e312ea34fbabc0e9b2b8c8ff11bf922e1326d332d3b1c057fc6f8b5d2f9ccb877542814206d7901dd315fe2d5000f3c02c5f969b15880195ee063dfa90cb8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422100266" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000042a06782976a45a76c223391f9cac4bf2ff8d0b5c76cbd6bfc8a5176ccde089b000000000e80000000020000200000004dfecfdf183865f1a49e163bf7c9665e4434be77732681cfa10b0c61df007d2320000000bc0789153bd4a36c5ced8753d46cf590f88f49c2aaf007a319118941aef5bd5340000000ce3ffda6a72e59e715fc6bfc947e0372fd3470295d05c4a7c087d7292431fdccbf781ab77f3de79a14a1072982e88f77d749e881c52db3547a55dc7ae20c5091 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E64BE61-1430-11EF-805B-F637117826CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1232 iexplore.exe 1232 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2372 1232 iexplore.exe 28 PID 1232 wrote to memory of 2372 1232 iexplore.exe 28 PID 1232 wrote to memory of 2372 1232 iexplore.exe 28 PID 1232 wrote to memory of 2372 1232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f5d40a9de3225370c5456fa6ccf0364_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5448aecd213ffb0269f27ae18756cfc71
SHA166ad7599cd483ca75d9dd23d322fa9c927773cf3
SHA25632166ea0fe5a89e2202f9edaa4815ad70f60d36e9023eabdbd706515820de0d3
SHA5123646107bcb86ca3c923cb5b0278d90e6b13db9bc261847fc53e5f848ba974ec5f91afbd4a671628aee504952b0f9f94057fdfd35c4ddaa7961b2254174ae2446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b4e5364ddb46c6c047049288e74f9e7
SHA17b7432f00d7b1100258aed4e7233b97c31685c57
SHA2569b92cd526d11127df6c390fe44baa08163c18b1c5becac8c2689728165937409
SHA512dc0e031429b37d702c955cc3e825e1fb4c83db6194a13f4496c03bfaedf8458b3fd5e4d60084fabc4d3b7dd91e3234661ef777cf3aed95c361c86461d1c103c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e9427755c042b905c5719cac1023e95
SHA14878e2c0d62e3c8b4ab0e5ed9683108bff60f3a2
SHA2561871fcb5aeb3e20ca3ccf457d5549f1fb8be1bc4f378d112570ffca5b9b73c0a
SHA512c3c833ba9861661a496ac604134f7c64f5a07fe95989fba7eb982b67f218cffbd468c36438a983ea170be58be566b73e22e334fffdc05ec8e4bbf2e8eff81f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51619d9d5dfce5b8ab4ab2267f901d46a
SHA14030926f0750fe8d9810fb4397552debe22c35c7
SHA256549ffcf3a40f7d0cccd1e88b370faa9944c2690e645623d82612bdf1d2ed42ac
SHA5126b4eaf413092a2a9b75d4eaea312d3810bbdec7d73eb3045fb5b63ee37ce2acdc6c9ebb2ec52c5240886f647ef34eb72f8acca840c6fe21b1c4dedbb3787b625
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f29fdb086de619f73b3522785a1c29c2
SHA1f60a227f8ba64a13258566606c39ad861bf42880
SHA256d5dbe24269e1573678412abc29305560b02a64c7b61300256ca26531c0cf8739
SHA5124610dbda1967179ac8f756b4428e817dffd7bd2a591d662c649cc2f9d62f1123c7137c36f01cbb4899900c33a9a18a782f4a4c4defeb22fd3517479af63bf5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e37f3d87a55b8d151da27f66635e5660
SHA12c7dec1ae5e98bf159eef7d9af01b7899cc01dc9
SHA256858daa7acd30bcf7a557e0f6d53446cc43568b9eebccdb25f0ea173b04e852e8
SHA512173ba9da147c88c34f67d99ccd1194e796581804d993840ce6085405131ab0447b7ee345ba6e019d20d055dd78f2888a1f242231971f7dd2fdcb0cb47b899b4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c41a8706d7f537fddceedcb9b3589e42
SHA1c4f76978fe5c6b049bb9be7b419c956f9ff2a136
SHA256e3f35e7a56f3d21d9eade49f413516a1c9e5527d3a48d2c3cc4d512a3c0c1e95
SHA51247b9e6c3dcd06099f45635da8c1c049bdeda39bace7a45cc53e74be17be620ba350ec5678000f0ab2aa38fffca01cb43e46accd7ec63c4869ea749b4310f231a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef2e89aa23a89d4acd03461d3ddc8597
SHA15b629ea0b538fc9397fa187d788858f6d407e542
SHA256ccc60f9d9f6609086d469b717352b42eb5fb52dc3733edb45149146b9639f11a
SHA51257a200afc1ccd1cae903cabcc4b7b91beb3bfdd8dc1158710e94c4cbc7063b6caedac5b628c6200e23fdc822be78f0ddbbf84575694475f2314f1ec2493eb3cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa111c98dd5bfbbcd138d3aebda8a7b8
SHA1ded4fefde061b30e7daf64cf347781edf461808a
SHA2563f96291576a2294bcbfb137c849513c1579744c5b851e2c7c307e8da8152d8f5
SHA5124d81fc4b5abf9bfd0d8bf81350ceb25d0f4ec2a6d31ce785db8a8fa37ed172947cfc3c8b257bac759ace85c1610a38e3a6aeb5dbb969432af3dd05618baba992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f3387c342057cf47695fd33fb8ac101
SHA170e60575b24ef3416285478383efb099a1d8d8a9
SHA2565be9a066cf03e8b58b99ddfa64804a2f32ad6fec9650473e9655c2a8911d97bd
SHA512bf09c19b21d5f9e57ad36eb95e18a70ddb651e2022b7a91cad276a922bca5efec8364858e96d12d5076b3e865862ca753646ae41fe74016a763c508631c44fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a847034cb3a4b6c585dfb64941370bdd
SHA1b830674fcc2e9453395e248e30c60ef5edc86664
SHA2566202e0abb2a2dad455c20efc084e63545e377a76a4fb88c7a670c4a9f73af45e
SHA51229130b50c7f472fc88ab5f736cc7f2f2645ddd5a55cbca3f84c1f2a7e38302d1c25fcb9a37339fb642ecad1fd832ec4b48173f14202d6ed76bbf7e03c171cbc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee2c0373a29b5325383c11a49e0438a4
SHA19f6528211a679a221bd3e7ad392a2788b515bc30
SHA256cb4c796196db5fcff6bb9f1e08e619ba44ae85ff41852fcd775acd31bcb30b93
SHA512110681992c3d205322877b8793c68ad517affd79280c81c3012b49ac96b0c053c3d8f350a7b749c8ed81d05c0cbf69399d26a2a1da107294793482efd4cbc5cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f2b3de0e07ac2a42d4610cfc5c94f76
SHA1ed5c4e8d04fe37a498eab88810a0d0b4a83bffd2
SHA25642ed3883dff2a89eeef59ff7412a431c484036716d0a4e5b998b4a199b964f1b
SHA512781474c652c6446113d2b6181c8676dcfd9280dc5eff370cb682ee22f878e65052e0b91bbce9af05cd476604de244db36bcd09c3bd71b930ddebe7cf5297a0d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcd9e82f5c257010cb6821f4df5fef07
SHA19428ef3a95e0a05e05f23ba041d3a6510e484b3e
SHA2562d793eb5beb714fc48c56509673fbed1d8a373de230c03abd2b9239132844a2f
SHA512518d190315e7851265639b9d3ec841935830100713eec01bfd0e38b9e168bcec63b36d4b3cf896f71b2ccd19072136d1ffa458f1c3b730cd848244ceb15b58a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519d15e0adc9c0f81a1fa3df6f1a4f849
SHA10f60c3b06ceadf2d4f96156e221af3e6135bb791
SHA256443db45109e845ffc57a7d7a3d99237002802cd9b2b7078def0e0b304675b75b
SHA512751dbc91c80f17a82cbe773fe65e49dc2a6e38d87224eee4d07029029db29a5c3175ae5bac37c8393e41d7f0b9c36e0370560a99275e6b1c91478a325ecdfb01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507c8be19a676ef7c4773309430bfe93e
SHA1e9f6e234c8e58642cc12f877628baf6d49c7fc36
SHA256ab4a5100a1242cfc6374e8021381a818951a04f7ae9ab78d44d39703cbf92211
SHA51218a1502bb1be486bf4f861cc6267e2ef7d4675bcfbf273d83b20dad209bf0158f035fd2a054a442cbe7cd825b3e24364be4f6b0adfc2a53576d5f10e2b58e7d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542b0ff77ffc6aacdc8098f85b116ec45
SHA1771a4722327ca619cdb6854a0f4edb6da560f19f
SHA256fbd40eadb696ba54d2dfd4174c39c04411f6786b6d73548bbf59adf852bc5e50
SHA512f70ead0ee33c950f0c362a7c5c57bce83f23d8e9c316cea2e94e46a58dfc60243b5f6852877764d568106e65c46e2fe3ca92f5fc50b7ee2f03ec022bef194f89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb3ffed4c704eaba4cd03bc25910d5c4
SHA11380e43e7812fcc3c1f6036e14b1e7b700e09b0a
SHA256705bca4e4c10c63133e2dc50a8d9665475e401c9603aee0df9ba77e6323d7232
SHA5121f51e43ce51f1bbcc46d81ac2dae5299fca3c17a2b6803636042df0179d8597d8e83c5d33abc819a0a5cfb8a850d45cc1d61f78ed101b84e4f95e2648c200d44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad788ebc912ded6ab52e85024b21811e
SHA18592be432c36949aa14c3988af96d421444356f7
SHA256277064dfe44ca04595fa5aa8dbbf8369edff98fd77a67c5a29d310b8180b854c
SHA51211b1336f08150c78f0521d7e00250f02ac7b4f3a5a8893855b82e39170a86d0f4f6f8f041e0e5e1f21d211ab6402b3deda39f4dae770429299b8cfb6481e3b54
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a