Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
614d65601e1c2e7bd975cfa899ad3f25_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
614d65601e1c2e7bd975cfa899ad3f25_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
614d65601e1c2e7bd975cfa899ad3f25_JaffaCakes118.html
-
Size
19KB
-
MD5
614d65601e1c2e7bd975cfa899ad3f25
-
SHA1
fac7cdebab5cca53ce30a66b91c3fd737ea45029
-
SHA256
a597189efb0573c31c0876d1b026796ed4ddb3567920091368f196e01037c30a
-
SHA512
1247c74df5a77e57ee769997818d5f8c334d808f72dd3ec7ef5f1de51e9180f55cf947f9202a5989d15b4876c4cb34b9d1f48ade51eedc62e7ca3844078865dd
-
SSDEEP
384:RpUdXxuE3iAy6Gc8a0CQdjomwFxS/mK7ZawL4CEP/tOMO/yk/:RpUtUrJha5efL4pG/X
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DA32AD1-1701-11EF-AE43-7A4B76010719} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906c27e20dabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422409743" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009a785d9f9ad4b6bb80f571039ebc4d215e9256874a3a4a09305d92a66d7a0e32000000000e80000000020000200000005338baa50715a7f762dacb539f9299b9e503f2b966e123b773621ebd7b98829e20000000fbd6fe3b2ac18da8e14f000969761f08503dececa62c736b323e705c858f0e75400000003a0991baf2b0b29973e1fc6ef4450933e0028db5ab28e7c74e81fe7dc5e6de8d6a25679430cf9c983df0ec84502217c51550f803094fb5163726af5653102233 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000197cb568b0441dd6740f16b496789151bb9e2eabc9c2c87bf81e189e7b3fb83b000000000e8000000002000020000000065dda901ae119d6d74f9bc769417fca77691ced2c4c1501212408db63e15b31900000009297dd84af8550fc1cd1da9774d1021406247c45e90136a8b43800478308d0be803c8d00cec42fedc06460ebd18b3056dc76c57ed00241b13a6448946c87ddf0e52b94735b3456137ffe71394013933280b3f0e28f8d8f985996b351dfe65c147188dfaf46280f7d4e0a46f9d53d688f175175a7e351a28a9247f65f16a299d73885160e8f1c6a1091b932e664ea8bdf40000000211d2c745259a05b667d607f14a3decfdfa59758eb6aaaed7a1d45ec7637b552ef671dc9fcd955f4b2bd7d8440a9610a166d493114ff7ca5837be6e9afbbe91d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1976 1924 iexplore.exe 28 PID 1924 wrote to memory of 1976 1924 iexplore.exe 28 PID 1924 wrote to memory of 1976 1924 iexplore.exe 28 PID 1924 wrote to memory of 1976 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\614d65601e1c2e7bd975cfa899ad3f25_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5593c3f6d1a8455d1604b95e98f1515
SHA18fb146008a0af2b586621479bec295d1e0697391
SHA256a7bd96b6f36f914ce4e3d1d8104cec5401050fca2458b59d967f4f9bbc142c50
SHA51295a269fd2f75ee573820885384a5e21d18dc314f0925e5a610a6e557222a6e27def438bdcdace48c8dd8633c8a420afaa684929a3f37962d0f99be5fb44d4650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5520bc6ae1b35b5db5150578350491f09
SHA17de3d466309a69b92572565da968129b8bf020c2
SHA2569e9cd3910da261af663aa044c34f643342f792dbc98fff264aede537f128ab7a
SHA512523b81cba9058b450387b751dea207b49d912ac5110eb8c9c45116adc1eb97e13355a01324805aa8192031430d8264c14933cb80002f691a9937c79d41de44e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c0a1dc82e64d4862e51db1ef4abb588
SHA1e13d62094574240e1bafc78fe92344018544ebff
SHA256cec0aac9180c800a1f593e377a053a0c4a3b5350e7a98beb25f657575c3e5ccf
SHA512f7dc37b052c9bdc119cd04889aeedc3401a41c6588bd15f07667bcde74f2362b7e6113eaba155152b9c1187c59cccc922e942e8f1a4c95e747c7868bdfb4a48a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c90c4323e601844e1ca8639ce2b97e0c
SHA186b2346b2426c4b050ad223277e3d3b7dfd5430c
SHA25629ea17a2bb77da241134a7d1c5a820d1f6b2e7925e7e53c36da1457926734b42
SHA512ebf84747964fcb1d2e371cda53c41cc8fe8150478607d911e5a2b1cd2b28aca583133abaac5221c3affc2d9dd0586a749537171024a405655108110fa50c9d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58006b705ccc2271c38c4fab5a6c057f4
SHA174b79ccb03173e41b718d8612935c9ee09e56b48
SHA256530af2964ddebb7af9423bc93ae564e1e1c30752e11d56ca8b4a0a014cf43163
SHA512aa0d3e4dcdaf8de2f0f24f258fe1970d2ccb32a3b4a392ab8047a5ddcdf0df49a6fb1fce6ff926a4e023d81d74d855ae59f40c53ca56d80f11eb78dfe32b60bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ff9ea79cfc2d8e80758ebcb661c7cc7
SHA1b246931575433be49448e2edd60c6db5cb07028f
SHA2563f4c707cdfbeb9907f33437afb973449d81001b358449a686468ca18918b015a
SHA5129d00c4e9535f57c9fc211ac061202e1d698f444658c169488353102a5169b7f44bc0127b83bbaefa21ecb7c52c3916327fc5aa2604b93f7ab1d2536484c84634
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a5c34c2aac05806256279fe9a2c95f0
SHA19d3e8b09e94d2faa672a877172619df8fea1b337
SHA25603631cd39ff8d24e4d611aa35315bdf50386acf12ff13cda0e256ff6f4778546
SHA512ec1b1a1e72ff7943ad242f92138fcbdb887c47f833131567cc705dd65fdf026fb98e143263fe4ff26a25d32d1c304ee512ea3f90514459477f22b794680abfd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515c5f36be2250d6a54a76a2dcdafe102
SHA10cf1148a9d00848784da30cfaaeba3076c8ab4f1
SHA25645825b9d0fb1a9872a38e37c271dc692a8a0eb98878ba6d8ac6f461e0a986681
SHA512b005aaf737632d3a0a0e9ab2435d4cfc8b3d7582fe5d6b683fe3d4bed37e7f5811dd7c52662644d73451fda4f165e12edaf8307e90f0794cfcfb5aacdf962f90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f71ccaa3515810a9485aa8353de866
SHA12a01f5a561393631a6d87cbbcf5a7860846bf9f3
SHA2565a6d44182807e59197fef4aa71365eef7381e28b99622714e6c65e4967f06834
SHA512e13831db8229d681ed91a484a1a1f7eb8a052a41898d2ed515c4656db29eed72d086861c95e83a7c842d777fa5f856ffee16214a74f4e793db162b487708d2c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f514b265ba5dbaa9c58498749d1aa8
SHA1dd0e1bd59056570afb44bd2ed842e1ab78f775d3
SHA256d3965e44118fb20343b8afea295c0a1d8a41479f7f54bc4e4d1b1f717cbcb91f
SHA512140fcc811284b4f551e95d3960234f9f43f5b01ac10d72313e51f5ea5105c4530aa7d14fff57fc8d2af2193c9fadd40ebcbb9185a2f5052421aeea315d04a556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585de8067e82702046c50d6a232a52ea7
SHA13c020bf4b5da4ad79ff5ebc286170bfe5bcf23dc
SHA256457117ed3ea2906761c6c6b5453251a86629d78408539c95e949e09a93bf0172
SHA512f66a9281016b413ed8c2698d2c8a5079c61638d51e63bf56e95c56cf40886329ea939c7e0e7cbfcf92a00843a80f3a43e55835cdcc4ed572c7b66451e589262c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5458edee19c53d378674a6035b06ab40d
SHA17b3ba94c0c9d1ae57fa956625ba809cc1abe9810
SHA25667dc1125b823400d90486f87a960a804ab7a174a93b59a70f15a4c3036f75add
SHA512923c00f60964cc171da4d6a910d68783f77abaf0735c061e6acdf1fc7c8fb515a54e167fdad328aad26904a9d8145fb88a3d41018248526c066e2f9e17d15295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ab1c250b13c91bd5d9cf6e2566a8164
SHA170d2a5edea6f886b88c3a79eea3f02b6d36b322c
SHA256f4d06f2026e3c08d87047dab7439ea3916d3fe1fd46045ace37d384c8a1444d8
SHA5129c14e3478f618afb3c650f75f12039fcc42c2410ed5d4ecbd17b75fa8428349b5fb8e263656222c47d046f381fd2337627263e15794662bc4dd70513fba63420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804bcb1182b99183a2202bb9f4a3c8a4
SHA1ee544f22d92b57774d6e921d84f938d7d1f48283
SHA2564689ec7e97bee885af9992618ac385b0a34962b189049ec44e13743c34074286
SHA5123557864bed2614b9e379da6d9ab1359c588cf7dfe9e7332bc2b22b9aa6eb520ac71c0ee9a633b78b678cca1eb34b03db2b109dd4200c70b90e44872bb92ad4e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a18e6266d0d51010d85294401363f9df
SHA191face5082b92463295dce4cd3feeacf0733dbbe
SHA256859ab1ed64a650df8642077553dd363f3e88ffe8d7e664f779447cc0c40f7dab
SHA512f6b514b24cdf16cb0adeadef52aa908eb8960b0e3c061a74ef67128959d02ac62021a6459612bf7576860c41146c81a2b40617eba28e86d494070cc27d2409af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cbef34b4d1ac80937438206c63b0d3d
SHA117552278c13bef83ba24920507dad1ec85a44569
SHA2569b8ad7c77b7b03902fb68dbffb7d8d8f9f4734db20a414965d31ffbb8ac5bd22
SHA51234397e2ce72ea47967b0d1905d79fb5b4ea4d22c2e975568a1689ae12e34d7d1ba5cc4d9900e2a4e7da8636c5f014d38b35bddc2da9ba0ec05398a194e720685
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59204c5c9335fcad7eb48a8064f159d4e
SHA1f3cc01841e803e345bffc5d98dadc302aa1a5fd5
SHA25651f180452c0cd0cb9adfce95e9588909ba1dfc30712b3cdd8dfee75c6f108ad1
SHA512af4bdd5f1754435eb4a602aa754b093e303a17f7455c22f6159d81f9960b371d3f630615c6915604389900f6a0e177392afbbc39c6643530f5efc70caad2cd62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5db9f862a6c769cfb4f976ea0aeb7e8
SHA1fe972f8402047e31dbe94329c334c697b1c752ed
SHA2560e683eb6363a7cc963c8b05db7650f513ccc1185bfa7a13f7fbd5608a3894307
SHA51281c6fe94b5048fbc0a32b0cf05a9f34f24ddc3682ebb8597e0bb97c2711517e4d5063876694c6340232e2a37d1a928cad4dea814882065e95a91fcf02d0c3c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53895de060180a61a1ced386dacbd24c6
SHA1bd3cd93c5e1d4d3627c6e876e4a05085dc37aef0
SHA256d0c9b40b0ab4d9281dbdc3ce135d01946b394f8ae9dd2ae4b663a4b575b11eb5
SHA512d09bf7fa0fe48da24525932bda180d8a04a3df92fc0494deda1bf64693e24764bd365ddac4bc21770687b8c178e623267d1d72fa36e1725d2709c7949f44c50f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a