Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
64fb559bb5b55038d499484a3f493ddd_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
64fb559bb5b55038d499484a3f493ddd_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
64fb559bb5b55038d499484a3f493ddd_JaffaCakes118.html
-
Size
1KB
-
MD5
64fb559bb5b55038d499484a3f493ddd
-
SHA1
7b078190ca85815270c3503a9a0fe700d1a321f8
-
SHA256
6fdd2e466d4203b2e620786a0da84f4e2072f040b8556f1da6d423ba0db34ce2
-
SHA512
1697596709bb9676cf9abd3da1f4c893c0b77f7af4a210fd4901e00bef02641f272bb54fa4a17dc667d860e74301587602015fa826bface4af81cf6320df8065
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6159321-17C0-11EF-84D8-C2F93164A635} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ffa9fef7db346963921a8d3dd9dd74e63e19d8085160849ba50ea480ecad52ce000000000e800000000200002000000052ba7d26856fea7a741231328b76754798966beb0feef5f66851f1bc270d90e7900000005b9586d6b8bba99e5abbdc87cf5363a6902865e1a2a287972929aa719bebe260cb3fa8633520c0938a51aad92dd01cada1bb9d5bd5207b43e7c43bd51f47980d1f43f7e81a2cce94e4762049609d8498ca2f6dc4a5d14d0140cf92da870b9ba0d82ca00a2de49469b78d6ba67002255bf9cf2722e3a9143045d1cfc1c5522a125f523a279f2b773143680e54308a2769400000004e8f3cd9d2bdbdd09cfad010446d3784cca3ad01aa39dcdcd031b7dd3a2bd29ee8a275d7d9951fb55cfb251e309ea07359b9b28fca1dd9d855f18b5bcea49af5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0419ebacdabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422492140" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009584e060aa9a47b53335020e421ab9d10dec94fb02fb5e01249bce9546ce29f9000000000e80000000020000200000008e8eee90f9ca73f1cd7c551f6dbd2af957b35f81fd6f12d72642a4fd42e447b0200000003aa4e8ea265bfacc52ef87a028f6c494945a2488d20166a7abdbefb0546ea55440000000171b70d3957275d2abffe060ac82d285c629bfe027aef190a2818b7a8113ae4cf221b9e55da275c47b18ffc3c5cfecb06b6bfa8b1846f760e36c334cbc71cfc0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2580 1760 iexplore.exe 28 PID 1760 wrote to memory of 2580 1760 iexplore.exe 28 PID 1760 wrote to memory of 2580 1760 iexplore.exe 28 PID 1760 wrote to memory of 2580 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64fb559bb5b55038d499484a3f493ddd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592df23583cc6f1374a320a528813a4c6
SHA184b629678221aaf6c2a650665da7194dcf789656
SHA2565ee72912b1413e3dbe99004a9229fbf46e6e5f05f12b6ab4244448b2bb645471
SHA51223493cc4bb2a0e09e560865f9d1dea5d2569f25b142262fcb6457e015ed5f1d6c3040aeea86eb02a7dc10c31ce214f9712da98c34c735346f8d12a9e116abc51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529d66fc0533f6ee8bcd0cae69eb2f5db
SHA1572256a6183400f0d2c35efe0deb6c4690c9b938
SHA256170ba70f67f7d9478f78d8902546d3edfc03acb516b8466fdd2680d24ab38b01
SHA51223e4f7cea48cbb3a7b03b4fe1813cb30195acc3abeb8e1141975c4d51036726170e536cd2412ff42aa5d38edb0bfc627c94ea777a0d8a90e0b38ede58d65ac85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b132cd56cd804f460d9ef0179443cc9f
SHA1101e84abf45cce0f936d9d578d151e4e272e6f0a
SHA256216b42abf7b1f27f3a7aa5701e718baf39737473eb9a4da16a71861fdf8ce4f3
SHA5124487d80e2d728de24ee87f0ebd213bd68f0848b2d85f2176335b3bd10dab3ba0523a1cf0ffb7f7f0b8895c94fc2a59aeb058f24ba6ef395fbf9433b5577ca273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9282a40953cf03153fdd4999d0b2e0e
SHA10f60bc36cf0cd4c3a6901c653e3d4ecaeec2df75
SHA256613d9385b44c728e9eccca4873bff4ce29f23b3a432b08388e576684ed4d9ae5
SHA5121db3db0dd9d831ec70d9c1fc81c8b70de6a2a2395391300779b36262d01df40e677f5f112847e2fa56ec99dd05a14e33934076747faf99a5ab9d33f328317f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564535f13519bcdb7c6bd8d0a48cb5715
SHA12faf118d3f9d63611382150b53ba0a7f0c096763
SHA25619c85e4f51773ad64bbccd99ff5660cb7bc216db53f80aceeaad3721bb74da1a
SHA5120ed628061db99360d58566a051f74576706c0a2f491041f2e5e41e5151f7f14086adbeec7294535550b87192adde83c346e295619c414f6fc1a607545e51f720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545783fa6d43a1d8453cb7f3e7a97d7df
SHA1b56074b340f062fc7921b1bf8e523f82d184f9ab
SHA256df5a7c6cc7ff82632f3b93af04b4fc98402db31779d290b5ed5b92523740f421
SHA512075c505b03f49e703f7857ed1f7b03634a7a9f21d0b49e56e38b36f46c299b763a832a833152ee8aaa112d8ae127a170b69ffaae612b64493e839b28343f241d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fe3de78bc0bab76e78ed054560a5f95
SHA1f7de2ff93dafed2276f55b6611d9e77fa23c549a
SHA2561c2640aa2f04c6377bd83af48dd50326fa22f19f8e37fc817892ba171a4401e5
SHA51259445cabf633602251ffa56cfea70040232337ae0b7f6b86ee48f1defbf9631ead7473684ec089a2f59849864ccdc7fdfa51b44d12cd1e9cf065ddda125e0aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ec89a4d2b5a45355d4bcfffbf842155
SHA14fef82ebe1e37cf45ad5e7165f802d63e7a04396
SHA256609386730cb22db91a976f230baee5e0ff185f2b05466ab458a74fc0d6d9b729
SHA512bfde289160a79032eaeb3bc9524776f650ebfedfc0d5ec2cbbe13edd45cd9e0d16e9bbdc0fefa6c7c8d3aa6b94252ca3d3a6c1e1b9ee48e03a05655774e16b42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f48bd7ab92bd615ce906b09894c67504
SHA17b5d41effe18a33099a03726e97953b3d7b2198a
SHA2560083312c54e9e9ef4849351f7382ac1df56227503148d012d748324fd2375985
SHA512bbb84b91395f28578fa812b3ef5d62797da5ce6ac01639c9fe7dbff1b276476b62a55835f31088b34b8cd5c39a8af04e31b6044ffd745bb7c6a9f679563a7d25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd9a852b0ba7721372b0edf85659b01d
SHA1088a33fe1fed9328e9d3f288e2cb9e3b74133fa0
SHA256af23050fd6e2272f23c330e6899ee503de05391e884e729130c66fc11845db31
SHA5127113b7a2890e85594fc7d4e7578ce8f91045e0f837572195215469e802655c2b28b1f3b3de4903783738c9f7aa90c810e0c34398b808bfe9af2a0b623976dffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558896d97b6baeb785442f78f5a6ff75a
SHA12dd2ceb164607f3cee89b3f14909205452318b5d
SHA2561afd6f967455f0dc67bd76e9893ebde09ea31aab96f431188f78c325e24280fe
SHA512cd7355ded3511afed4b0e4e0b9181a44844fc9f4435d6c93ac7ef66be131de6ff3b80475953e17898015d217b3d6c85ab096032a56180e8cf7725d971b5cd323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573ceb0667396c4fb4748fbcb97ec2a88
SHA15d1f4834401008d5e68bbfa1f0df4e69cf92eecc
SHA25624b10e3592a22ea9a3f850913dcb257972ba6c879488f644a92a8e4bf852d417
SHA51247a6d6957b5bf5314cfe15d739f428520d82ce4e362306cea4cb6a5f618cf39fd92d33ace11574dcdea54abee0b09d98a442372c059c79b9440a7f8d7a528a9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5722e41895134c478cba11dba4019d5cd
SHA13f620f986ae49e11da851ab72c8b3d456baa53f3
SHA25643b6c81f378e41d3d3f32fd4bc1b8ded8a89aae7c586c2ad2722daa94b9c21dc
SHA5128904648e9fcd49e130bc104ae99bd28637cfcc4601607f2093c78e010f31a8faddca0eccde819392091010d1c55c7f410d2cfe60e13290e3e8ebb813a0f22f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dac1ca8edc463bb056ad0bd9aa3ee9d
SHA1a2a50963dcfc196b4eb846226e1c609a70f91234
SHA25640601b889f3c376debe3a50f00d8ff46785ab1821f8e7fa97a65cb240caa2f37
SHA5122a26dcb2d528a1cec8e8343009614a5e1b1b28607b9bf2fb6c802f5117871f9cef84ca0d6aa26990e07adb0d8db29654ee50106deec3436eccc4cd3365ae702d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed574fc08136a10871eeb00f447f8f2
SHA14010c7b1d00befffda49cb91e0a74cf71c8f07a9
SHA256caa316892a5bd1104a5cf934f6ead24360d3542b6074da5135f1cb443d6f6203
SHA512d41fa4122034e8613478e47532e8d46aec449c400a18256538e51a222d095346e3d5f0688a2635ae982287075a5e682ec46866933ede4a931188ef7bea323eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977cfd9ac2f1680dcb797f0802bcc3c5
SHA188bc8aa3f9d375b8108be2c5b22c31bf495cede0
SHA2561516fbf647749185c97d7f58e3650a0a28498f5dc0eebcde529b372583a4de45
SHA51271b8b1c0f06a5d15f12c7abff9fcf0b543f902e08569181d6d0ebf627fd21c2a6d87bf307c7946cbad6840987729b4a978afe649b09e1abe89ca30eed256d3f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54968e5845e27e5ea76e3e87e39106e99
SHA1d4e75d78da3451695478464964d178c2e78d80a2
SHA2566ef781890660ddb02f7c443bd717deedf8dbb9e1ebdbeb89b65b214f00fd97d3
SHA512a1d8a3aaa49bbd8a8ba89a1c1f564b9435518e5bbb09bf69481152c4e51c49f3552648d5eecd5b4b14f762e9daf912bda1de46fa6252de5455ac3db0b8f16ef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bcfac0d17ed5c1eb1ca0e851ee5d9d6
SHA10372428af8f34f6d1065cb8662451b7bd22d9aaf
SHA25681d6058ded5f543534ba6bc7357df387cbc3160e45775deaeb3f9970e8f608b1
SHA512acbe53519a437eff99df317ec5124c87beb44c6420dbf93ec7675efb5f01223267fedbdb5d14553af96568eb9ea01e16e7227e888e307f79177eda50bd890bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4aed8bc8d0fcec01bc9b065abe21e05
SHA16934c7a6cc2ae0522d8c7ab901916c608f654b52
SHA2564177b23a1267fc596c9ab5c2f0d7a0bce92c4f6944de6ad8b5b5f64e7e20bcd4
SHA5127646fa14b074c18d79673af90648572f64fb57013ab035e435c252227ff760a691af8b98960a43d427c862bb1a8e82a2d81e35e5b2761e3fdf8c3f799735a661
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a