Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:29
Static task
static1
Behavioral task
behavioral1
Sample
60ccca577217323555d1f200c4230f01_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
60ccca577217323555d1f200c4230f01_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
60ccca577217323555d1f200c4230f01_JaffaCakes118.html
-
Size
3KB
-
MD5
60ccca577217323555d1f200c4230f01
-
SHA1
4fdb592aeba91aaa623f5792c66a1844d99a565c
-
SHA256
19608a0ad73fb341021ab827eb56b4682f9bdb12df18d1651db429f6bba74657
-
SHA512
2df0e642b9b263e077e071ef7d52db2d01f3ed08c4997d51369a97fe7b7acfe302d4f234c71bc342d97edcd2a6c4628957bb659463fc02b499d8f76985597be2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000086bfe101827496b7d61037a85ed8bafe3c43132adbc8c3759447c48f85d42ac8000000000e80000000020000200000008d4da995f3704d40c43ea31ec02099a620fda125db6ad82f0203992ff49d522920000000eff419fc9e353dd9d8d34b97ef20ed4087f3a5e46d9568daf722f8584099c96f40000000d020d95d62666c2ebed49f622eb020087358406312c4093c6ebbfd01f27a5acd8bc0d895a52f15c4d88fa6b4bc947ad1ed43d050a5be8a0435371ca8e4dc5acc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{551ECA31-16DF-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000aab2e8f3d02889b3255a2a2ffecda3d5c7b840c420de41c01855e76d38362418000000000e8000000002000020000000a5f8ecde024316633dfc620f3c506949338b92aa146f00b71a4c87d36ef1d4ac90000000fe16a66f6cf51ba2dacd04c4808a68278baec9dfce7d76a629f67afcb5ea5aef2c24e6fe0003a56e6743b409d99953691e7a9aa290365f61149591e6e4bd53eb3a5017121f2ae38e428c470b548c58d1c535d26d2a640e08f5a225d57b66b9747db5a409989fff57b34530a1432969c546a9bac47c2fbef86ecebc32969c1a222b3969c446c7ec6b174bcc2a9f875e64400000003184b7eed46475b7fd07e919b82c2bae28138a7401304a4c96127ba866e41f1ec3bcb4c7914b1a821f1517e424ca27b90ae9950a3a8ff50627202a45fdc634bf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422395260" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00aab29ecaada01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60ccca577217323555d1f200c4230f01_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c145f9a9adba5f6b4f1e5ba9335885a
SHA1d6ca24f5e51cef27e0f0fcaffa4243c617acefbc
SHA256661dd6720c38b8d2c85e9e2627b8b71fbdb9949c55366f0194b4b2cc6c3eb759
SHA5121027ecb159f84c2bbb141d19b49f1e0a583e05cc7237e54e58ed19ce96b7bab89c643176481b4165141405db60a6f52f5c0a168a508683562fae9981df5c3f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3150311af9311132968081d2663b956
SHA14bc4dbb3606ee5ba26dc5d0191d775429ac1596a
SHA256f1414c9a83394290042f5e0cda723faa5403195cddf0dbce410e765fffa40e2b
SHA512d42068f68d95232ad7646204833a32ae83c27b87264456bfadd7f23fb2d67debd11a1f7c532658e3aaf5a46fe01856ac1113ed28cb5b3e22545961abb5d38fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f868318fca9b50a7e6b2b0d2f55de338
SHA16ee0c4cbb42ffc85ff159bd2d00a7f61a3cfaabd
SHA256743edb31e2654faa8e167b28f16880462e10b1b673a1ded2ef2278a006ab4ef5
SHA5123142315d3b8ca92fba0d269a043b0f83893a4e30376edd0cfe6e67d23bb4b3174c5655930fdf51967f8ae07c093bdfca145e4f51d578d002b5867dd662b66f13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523a26ddaf167345ab93c2dfaaa918e07
SHA1dbfb295022e6edd13f7d1851240884e6551d3d55
SHA2561e5a2f475789914db916ca402496e68156f0a9db170f7d7130c61d3e3ea37ee8
SHA512af277d5ee0a80dfd52fbe3cb7b71d1aed10ff88c1bd8913a1f1fa186ef1fe45544deb47cf6bb8683050f0ee8761d1bb5e48c58cb367731a60708eb2b1e27ecac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564f255d804225b01365a1d45e6a2292e
SHA14ed279d894f9fd7b8aabf5bb55a2b89e5b8c4369
SHA25680492c2dda11a67c4afa7f822f2aa00b377132e1278660574f3475d30a68f6e5
SHA5126b783a2c02dbd1ece4d510ed96be1ba59c2643a6d73a9acfb3f5bffe8222aef5693c8aebfdc8e6e93e2be9aae4c9f13092edb962ac02b96ab388d567d6d430ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce1e0f9d0ead23abf8648937ba751a85
SHA193d231619e314860f85838b1a5d8a71d97bd9cce
SHA2560ff477ac3006aa63630f2ccee94465bc26f7be7227dbb6557a8acc1d5627d6ee
SHA512ee61b54aba2a37a15d9106ed8552415305f1feeece47bd900cf50ae60bf2eaf2764ff6e5e1447066ed0702924a7bc42d992226c537db8e17e83d8ad28fafce6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f132a83953793f55614d6971134b05ab
SHA12259b6e30140ba0d8de9673a255fa72c659a5aa8
SHA2561be3d6ee2b89ead121f4f2e6f07db3ca113506b0ff56440a65aa25a75002ec2c
SHA5121c1412bdacc965a45bc8c6eb9ab7d4240483190f9a9c9504ce6485c7499a6a4a446a4fd5aa6229bca4d905caa7ae86811c70f06b6b618aafb6aff7917758df62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c04d66e2cfa79e67a4f46a1e4c65d38e
SHA1eb69c5225ad5de507fd985f5ac1ac57e0ef87fa0
SHA256f662b447f5f79c99232f43fc1931f753abda466a7f1b88f595d0741351f8fe88
SHA5121da29bb2231f7f8caf0f4d67a81ab5312fa34a5254316346cd540fb6a7522838f129c451e4489d81a9be09fd9a4f46b61553a01d9d356410e782a8e639c69723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501d9654897722b0805c874d1ea3a4888
SHA101cef3c3a43f06a3d7f1c938f90ebd288c157b43
SHA25645f96d09b5fc528af01a6fd1ad7349e8ae229aab306bd748feadf5bdd6a16369
SHA5124e2aaed39b10600c074a6a258c3dd2b2beee447466f5a65d97e8afc6fe8f8d0010bb9b38b62a969c506e004b0ec919a26b87a6f8577b4baa58b15761db319386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526887a953532cfc25cb5f1972d060a16
SHA13127396f585ee87926b506ff7bd029cab931ff0b
SHA256e7b07e6e5986bda4520a6298ea9ca65f2afadc1cf991a61e63f79d0b025078ac
SHA512d140e43ce978f1121f8b9bd841b2af316122c7acfff0728eabce9db5eb161cf43843577c0bda2c93a74806b19e21b70be160d28b63fced24b35245f45c9a59b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e00d804ce80a117a29aa46c519378e5
SHA12fdc760240fa63659a78b3deb3f966c26d43baab
SHA256d6e10786e8787ffe6f4d7eca30ddfb5cb83a6c5e76150ec66beb36aaeb02f5ee
SHA512001aba5120f8812dedfda38fd8c95132ef248d823fb597bb002541c1f065f5e4c2c4fce249510c691ea9043c1ee555b1dfb72748cc2bbb1f04a2ff45bc92772b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a413a880a1ed1fc941c68d73a4b81c9
SHA15acf3a9c94216808d9d1b6ab213a81d0f0d3e3a5
SHA2561b31ad06d3b8a19abf94b363f8079e3354967c65eb3933e8d67cf999a636a610
SHA5129fa43597235423f5f87b9417fbeb247aa8d27e3597b614d822fa8161303ad879f5459061a45b6cefa14c74b05f863b6701792f6123249815e65ef817df80097c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85a52329efe220139ee1f13a48ed4ea
SHA12b74ba67fe94d0925dacacfe634fe5dde8d4697a
SHA2564fdb0c64f5962f53bdad21d4a0f639ca76d1f3c43c4753ef092a86f8701a6185
SHA512669a27dcc0287a36c026af4fb5ab44c70b902322b0490cab432904b057d634cbab73fb8aa55cff072a14ffe8a2cf6bcbd3b526b796f6aa311cbd6aecc03eb106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516d70241c7773683ba6e8c7cc3806f4f
SHA12b428d1655090af696142cd3745125d835a1776c
SHA2562d1f1b8abf21b914ac85c0ea3da942a631c392c4e4e92d08a095df4d7e2eddc3
SHA512d55f35b9bc5f71c1c0bf21ac4b53526297b8e902c12f92a952f71d04d8cd3cf9c30ea4bf88751a77bf5b81ade820f62f812b104fdaf0e321ccaf85d50d323a79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dcb7c00b4278f549bb17f3c3f75104c
SHA15ef8ae28bff010acb0f2da8b889723a98515c604
SHA256192dbeebc676d995c6ccc431986f596bc227b67a3a10c44fb47593fd679679f6
SHA512a08619112b4e1817bac6e0fed73e4afe99fa845c697d3a75ba3bf8a9f0826d65c44d757f4c6d601002f32f27c73a5206480e8c54ce6636bd5452f98024076a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58df8ea4b814480f00efc8c64dd627048
SHA14900c031f56a44d9a1cdf2c912936c206113d62b
SHA2567bed33a721c651e03d7dcabb7193a4ae5091e5211490a82435028a178636f074
SHA5120f729ea3534c590dde2bd06b1dc471c73991ab12c5e35d67cfd03b5b540288524e38990463f0340bc92a8da80614d243db0dc7ba9493312ab2de1cc848c5e7a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c8aa65b235c9595d0afea303f989d2f
SHA127ca0e5faf1be3bff28ba2397e1dda958a9f5e1e
SHA256cfe25e87dff85956d0f0b2f00f5ae2dbbde8249c10a5976b0dcb563287e86a2e
SHA512cbdb38e4a4d77fdf07056c7c63f7b12d6969ae27ea9d77c835972c84d20cbbbfb7ae3b107215d421603b9d99c4ffd834cb136bea443b1ab1002cbc1a3cfe64e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aea6b10af3ca2dcd6cc451903460de7c
SHA126bdb786ddc6c1dfa026828de5e9f2e30ec32fb1
SHA2560a4b78bb63b0e75af679afc56b41669dd2a6e8b72db4476b7c5a23f5d4425acf
SHA512a460374fc9ab8ef981184b862e4ae64659b816c0844544ea02aca76c0ebb87ca76d371aa9f1b6f6afa76e8f11ed1dcab3a3da20d295da4c4afd8311ad0c96da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578a9c257694718cdac2e4e25c504207e
SHA1514e030ce910d09f710160cf456b7d3eeab10e51
SHA256a084bb4a2768c9550c56b6f9e395671722ee6e25d048d66da5e523478c329057
SHA51201fe007f6e149f24bd557f90b237975ad3b53a0acf07845cb9f3a7386fdccf91a64be54d27c2479d3c74a2fc99136e366900088d082d7840765a4b3f99389e8d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a