Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html
-
Size
3KB
-
MD5
5b6a5800db22a2e6bc3f10fe6aaa6169
-
SHA1
5cf4e4c1350ab56513e20f89e1b0fac479b6703a
-
SHA256
eee3c8943320346e493ae93644e9f507a0fc343e6161698bcc3d8e24329b2e17
-
SHA512
9f339062a2e7c15dc9831d98d21da636a4506339bf1b4129ee3468ed4a2a1437f4af57f9ecb5c9b2dc2179647b251dac6e74f72b9948f690f79a7ff0d96a4f28
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a610ece45b7ce10eb7057b2622e8b24b029e4638f1bc8e070566e1f410393329000000000e8000000002000020000000445f7619c8a02f7d6fe0a4f6708cb00779c874ec8a90ea1eccd3fd14f7fc73c020000000f57a718e2172d15e586a3abffde9a38d8b4e8303fb42f833d5bc56e8f82d20e64000000031b3f87d079583e011a62ec59ff0102ff6ef97a53a4f10f6ea93c42941e26fab0001ad17d0490fd56d1013741ead6be347fe64a3a0ee0259e59624c2a7aca6db iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b088d630d740234b7ca60078513631051d43a6db494112045a8998914b7375db000000000e80000000020000200000005a63651f6f7507768acc033f5fc0f3eb511a3d16134b8816bbe836a019e01e1190000000c6dec21cd4b8ac85395e640ab454b4de08515ed13e4cae0366f77afd261a27eb93db11bf1acc64bf1bc1f5a85a29fedc03a6a837c0b3941ab64165886255a47d7a39504d088ea9c1032a53d418a0db0810f1035e521ad5cf6628ebb6dd86cadd6a4b55f8f181f9f0a6566d1c8ea7a7b33bbaf7c36409abfa804a23cd51b8117055d6baf9e6fb2c385004786d372702ca40000000b96d21281c322e7ea8e264f1c8ed76a3194069fe8b2ab097ee48a0d0e99bc13c951b3c039c1fcb8fc343d2ff7fbe3b851826ebc0eced9c08ad29aa5f64fb94a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC8E4B41-1621-11EF-AE65-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422313856" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903232a12eaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2580 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2580 iexplore.exe 2580 iexplore.exe 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2220 2580 iexplore.exe 28 PID 2580 wrote to memory of 2220 2580 iexplore.exe 28 PID 2580 wrote to memory of 2220 2580 iexplore.exe 28 PID 2580 wrote to memory of 2220 2580 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6ce7018c5756657579c498703ab215b
SHA19dcbe5616f023e745f949b024f2a52aa90c65a67
SHA256dc4a2d4cdb3e4404cfd79e72a7b748f6d0e90bbd176054d1b01d0e6059f256b5
SHA5121038d6a70cc6458f1fdf0acf2402d274e2b8ffe695ba70dfe617aa197961a83ac6dc837a8b02ecbf01b60ba97dd70e2939ddd38fdd674fda16db202d55fcaaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58996c80d4f8af2ac2d715dd856312ee9
SHA10ce410b6321eefeef6b1f0a68b5afd392477aab6
SHA25697e82fe0bb55f6a04a1028be2644b29eb7aabe33ca4c0b455821dd963cb58dfb
SHA5128ea57816ce7ca15630f2217077f5705bbcdc13b586dda6e4ecea0b38e3f14940a30bcb31316a32e46867d8471ae847c0338e1e69c3a682a26381d97f8f22ae1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a0da944bb3df3880804d1ecb95cdfae
SHA15747b697a0457b7cf609b89cf7fc25b12f4ae642
SHA256685b6900f6ed5dd5e828783fefcfd14386419a179eb5cae3bccbf9f25bd99838
SHA51208b86717178ef82ea01370b7048ef6177b9ba9c08fae7f68b1ee7de5b17a796cc21094c9c524098136f05fb2dafa3f27078dcb0a9c810372eaf496934469d514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee687c7cdb251b214fbeb312672430f
SHA1ed03d0b7c0bfa3da69cd1cd7b0bf456b80240529
SHA2569ce4b67636e093e3189c64e95dd7fe39be5b5e02387a09ab82b3352b24fb1831
SHA512389aa5090401f411a7709efdd0625774eac5835fbd790c5dac2b4199efb8c4174e9cdee047bf6c7d63e4ec2b728d0e9f2e4afc794ddf9430aceee06274103028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a78236c114979b4815512992bfd0bf3
SHA1ef94e1345a1b7371930a294a3c4a023e53b803f0
SHA256249d440278aa2974f87245344bf33e82c3520c310dd4afa13d03069b0c8f660c
SHA512064c87d0d644e834e76763adc9058fcade1e8519311856757c48359a175a09a0533dc0b7fa1acc7ea5d489073019933244bb7cfc2f0dd1de7f0bf0e8a5f25554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57490cbf5b6cd5ca120e1152a7d7b81bb
SHA1125cadc49ffa4f6196a41afb669e9cd2ab037d15
SHA256cc97ab47e927182b3afb00d18e2da0cf59b583a4a1931791b7964ac0467fd620
SHA5125654d1f5b70865da1756262d937d87f4284e0fb7b30015f5596c0ce1274995d34d5c17aa5aecc366027253a946af8f933a1ff4c65f6283aa0bf9cee2dac506de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6b127271a29b2ff707b5b0416f82f98
SHA1ebf72fdc12a49fe80e30dc16f47946ed0ed84759
SHA256c05d35f54295e26b2eabdb812b84019e4b7a9e5d90aa21928c1f3cd469e9fe34
SHA512752eca0d6bd704b8434dbd4fdc5d8c3ff70956f49b52d96f91082ef9a6a0a6f725d983f0e210b6823ebdbb15d08db9e8a1be438b6c1baa44eefc932f65dfee7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0219502eef8f5a13507b0aa413c374b
SHA132928fefa764fcaf23316c096e69341bdfc054a0
SHA256e248daaccb3320313e61304efb814d475bd392c378c71b3d703ab8c08686bed2
SHA5125a190da878da134684889b6b8f230e503ebf169739e4eecda95ef0c45fd5e99d3e7ccf3e38693ac856be7cae53dda92032d1ec2531ba0b60ce9a543cbe9ad5f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c293e843a50d8c760a79f087c18eba3
SHA19310337a7bd91dcb5b2246fae90f55e49d9ec8b8
SHA2566ed2471507f4d349531d7909bb479d56aa48255f2614aba65d7da32a6cf71a60
SHA5124f81110ac3a141deb5fe79942ed247199a7a4da3322ceaaa6f38db0eb2f53600d735ee9e62982ba8cab80f980de6d76bc85813025ea961e18669d10771f8f5ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c2dab96f893e8972c0d5f75563a39cd
SHA1c7c827975da24affd43abe81b6b1bfba8a367f0f
SHA2563c2b1f22ac746f1c39a1103cbf13fa676471d5ac76ebcb57d24d871ec0161593
SHA512569cbce03697919cf8f71804bf392d4170d73ce0e406439768587faf9517e221d1324a865f82710a5b13bf08e83c148213b1687a2cf68cc8017346f9c215f892
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbf4d9f9814538e1f2698e5e9809ea7a
SHA1a2a65e4b20be4f8a4d3a62c6ddfdf1efcde1fd64
SHA256a63ca1450e850d60ca778508412233286c29517be50617bce80153d187cf820f
SHA51282f75d7043718bf45b0bdcc8fd526c8f5feae8a62734792394b66f80e3549486238442407528ac3191150a7299a0a60422782e416301cc89db6e4b704d8e4ddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52685f092d30b45187cf36a9d45fbcc3d
SHA169b99c6bbe68fa466f461d2475f1ef0adecb51bf
SHA2563a43fe66eb21cb46331477a28b675572fdbc8ab5b83258bbc85f00636733d779
SHA512be1e5514969991af0cba603e81953ad977932b10d20e5f239df5c84feea48c5cd06fe5230ae1ae84b00518ef63dfb1ef1d74fe442ebd08c030dc2477121bd9dd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a