Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 19:03
Static task
static1
Behavioral task
behavioral1
Sample
646a59776a94b7b2ec2cdf594d609634_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
646a59776a94b7b2ec2cdf594d609634_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
646a59776a94b7b2ec2cdf594d609634_JaffaCakes118.html
-
Size
461KB
-
MD5
646a59776a94b7b2ec2cdf594d609634
-
SHA1
f0c7bb182a7786df3bc2ddc90a688c1ac9d4c6ee
-
SHA256
4435bf29444926a54a36beb98494d1969cd5b051b606243cf8df5cb6e68e486b
-
SHA512
ca9e832b9c178edac3d25f9e723d78de40b41d7e7c06986e888dab22654b1dd51dd2af0f3814c9150548db6c46c2e81beaea7d8710454183dbea183e1697eea5
-
SSDEEP
6144:SgsMYod+X3oI+YBsMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3H5d+X3C5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000002026d8aa68c74e81359f3328d81a4a0e4738593f4ddc0a81a27acf6f31fdfcf3000000000e8000000002000020000000c00649a3a614695213ef6b1582f0391e4179d014520b547bf762d395410e6c9090000000a84c786bf8d60df9ecb77d2f79d51949f09f8c0e8fe5cc4a634ae381d4eee66b2893c356b51cd0c918f2c6d3c099e2328539ed3470f725e846c95351f55377186c727c0e68b1fb5c9c49e9d64a74f69a18bda699b9b23b2627a8f647b5e4c8e731f39b647a596352ba4b91105508c1354a1c453c6bb726ae4450747e9cf24f4ace26b364aafe517f2830d47fc08d7bf040000000bc189f672895585a82aaabc015c40b008fcf1689b912182cb477807c1212ec49bdffd75a2e5804027c5b1fd1eed3c8c6d40ae718ef8a9cc706f1435baaa336f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422480092" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f13339b310a7bf7803b57278fbbeefdcfbe6ed911a8404541c29c41cca9acb2e000000000e800000000200002000000038929ce83e7ecd579261c0310e9255372db318b76d77bf457a3aa7bcd1b023a820000000f9657be853ee0124bfb49f545fc02d2cbfa087648b0cfe9659e37ecbef6caeff400000005d051fb5a38742c2d6c02e7b8d0b424bc81f7f177e943c31186f5cc8d0b7cf3ef277185df9cd46f241a62510c4d311c15c6e7f5b39ee4c2a905502daca92b7e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40220db1b1abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D86CA951-17A4-11EF-B44D-5A451966104F} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1712 iexplore.exe 1712 iexplore.exe 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1860 1712 iexplore.exe 28 PID 1712 wrote to memory of 1860 1712 iexplore.exe 28 PID 1712 wrote to memory of 1860 1712 iexplore.exe 28 PID 1712 wrote to memory of 1860 1712 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\646a59776a94b7b2ec2cdf594d609634_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c38b4c224f4ba3e218f35e56b2c59c6c
SHA15cd64e603b1f1ff912830fa75691e31132623507
SHA256824e6870a002b4de10f8a702e633a9b48b1ce8750a3c0fd917385dd0d02ec5b0
SHA512bb2cb8ee038c47f52bd58f850429cc917a8f4af0fef02df61158130422e25f74076e5eb29fc6107e3421c499c9b04ebe5c9b7efe0ec5668c0b260de302941f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56385c13b2826aec9fb428383eca0e43d
SHA19f5c4e2904f5235fad6c44a4337b2c2646f67bbd
SHA25639ad05bd8478ccf6bae0aef4d936df26f01ec4759355a570be6749d64ded1f28
SHA512205d5ebfb5fe8b95ed70cd54b640a351d236f92bae8918b17d144a9f55ea15210ce8117cbbb8f3fe911da39fe41296894ea670102b897291d1966ba19835f04b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c248266b44c0c4007f43e48b2461145
SHA12c4b485a1bf3a6c89ff9fcebf062b513f8d6fe43
SHA256d1159da96dd69d21e5c32a1da7c152017689cd3365672baf79254d73476abcfd
SHA512cba91b4e0957683378b474f5f1723af4ec28197a7f745a473103e1f0cd646e3934c3ac814f3a7ac2ced5f8bad53f9addd833561bbfd6b7ef8ff97b896b1cfb84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea1f501ae53ffe02e3151fb7f492384
SHA1b82687ab098da593552d8f8c68834217e7b79ada
SHA256b91a07b90df28fe99687519d8026ffe3b8d1bedcaa198bb68c7bc478903b58b0
SHA512055b9facc3bc45c779ed770101176177f51cb849c0685530a053aace8996db3c544e9068cdb1e1ee686531e20214d5b78c57dd5f0bceb179a54b53bd87a4015c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3fd05a66b43e28e8866d2baf5af6706
SHA1dd2d1e6fc202224a611ebf08b4a8d425bf15c658
SHA25667d3d542e528e3ef388637d9a63790e09ea12e052346e49dbdc355ea165ed467
SHA5125a3ce11d597a9c0180da91f411231ef6f88ef6701516b3ee47d5c876f5295464744982d1b81368f2919c7c5709f2f96db6d8f215db85eef3e617c9f3d3a082d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df6053cf22381e5ac7cd0386adcc43cd
SHA1e974a19c0c0582fc02528c0db069933b4b5824cd
SHA2566d0a0d07a4ba3bf23d2bc0ce328cd7ed6a2d0d7a73ba8b5c15bbb39797f713d0
SHA5124d49cdc53142a53ddfb75f244853c3be34dbeb04332ea3af5ebfc6afbba65178808d6c379fe09e373d66342de944d075fa65627a95a84f04299203e67f71852d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b68ec3ad7585f1c36fc00d4e93e3c64
SHA165ae13eb96f9ec8013a5696c6f1adcbe3dfba9dc
SHA2566855acd18f8f6c122aed1419c82aebf63d8ddb9e7119356209fcd6cec9fa50db
SHA512a769759d7d161e6ce54d689a669c0a513f9d2c6fcbe8c440e3dd3d2f5c0e64c0871b2f4fc90e56104c84b3bf166230d78b92c04ae44451c950eb608af75fa5a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a261a05b8939809ae8bdcdb9cfa15066
SHA18f2b739e2bff06234ba1f3f7e57e662119c16962
SHA256526fc148178cf433607242b6a99f5c85e17f65f95e3c9bb6e1cfce2f7cecbcab
SHA5125ad0a9daa1e029902b3832e6087ff128b0904243927eb2b2743a3227640e83c812d9eafb61674854f1b2777ca09e43a62ce8dc378c5a16c164732ec498d406af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9d3c34a453be15aba07ff0668d4d731
SHA19e802c6a2116403598c67c9f5db39c869cfba86e
SHA2564d1139fd7a918cf3b226c263d8754e8d6bc034fa4f5530eeb80b268d80a577c1
SHA5126e230698a5ddadbea656d8f9b0914e2f126fe6444318a55a67a7effa76f71a0a693e64d728f231dfb2f38f5814c8fc4da6028317174d23aed1c28671419dc06c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a47329b08955ec4ea2fe3fecf008e84
SHA1ce4177d287e235470be1669edc03bc19e37ff1e1
SHA25622ea1f865a20ffd329de0691e5b1a62844d44f883e83f93df8a7c20823e1b418
SHA51294a1575df63b1cc9073fa1908310a4f54399ba882292f121b6ff5b80e6346f3bd8db504bc6e1d5776a98e4c3d772773571053d5418625ee31e6f5328b1287881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ee69748c433896331c50112e8889b5
SHA1c43c1328a995c66b57c44dea18937fd1cc21ec68
SHA256ed09a4003132bff9ee1bd36d8de96fb81309c8c20136f2f320f5b18b62589a32
SHA512483e06125a13fa973700265bb71ea3b0e138670fa09238cb556a7b86a476653dd8cbf599f5a6ef0ad64b61da8347d6980518af24661eb38bb98a40bd77bd3739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d58bc38d18286c155d967f8b06737b4
SHA1033e5cbdd9711f0153c935dcb968822820698355
SHA256d64be8bf7fc405dc0b0e45e417456520d3c9c21d46fbcdc3bfdeb363158ebd0a
SHA512258dbe1cfe8b448e8250cacc23dd6c93e331bb1e43ce3fe6992e3b320b884f99a4149345479958659f28bcfbb813dbbbf7874a973289b82f0402ef49e8ae8bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ebe53cda826ba2c251548e558767356
SHA1719a3c9dae5a0edc070dac0c07a9db010ec5e585
SHA2560449dff4a9f8b7cf0be2b68951baa97cd1986bbce8bb3af1ff526e66a26fa39f
SHA512e215b129b60a4cdc52142b6116feed2f8bc6b07061a2e4b336856afddf92f7492b3e82fcee93b10564ae4e92a9f8838fd63a64f6f850d833ff6bbd9a54be4b8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c35f12a95488c8baf5fc2272fbfff03
SHA189e06b054b78a635c4b0bdb3d51dd9f30372ebee
SHA256e2bd29fca357e2b9e31f560c6254195d0a29ff74c8533733f8c2d17303c56237
SHA512efe51be0b8fe5eb2f1afe23742931a4f0f7259efd996db47ba46d832b811cbd9fe98cf8ac643729ba73f0554023d249d64e27c40bf5d58e24aae5b61c8863263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f4a02925054eb561dc4b330e9c6f11e
SHA1d54e59304b3f1b6b7b25e087dead978e6393577d
SHA2568423668a6017940167f0c84fe0bd4b4b36923b25a0e18b4007dc31b58e414920
SHA512462da0809300b77b5379e5e4674a6e5a0a34b38d8cb9e699bcb52d3c5e72e281c08e2f60183eea6fb95cbb2245ac1269e9c6126376ad1b3ca17059b661c29864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce935257ecd94dcfee794a9b18fdb028
SHA189c8d31da2b54c535a3eacb44a91f9ed0d537d10
SHA2569fc644385854d418b17751dec6f17428e9eaf27ac5c8cd4e1bc081d5d0cdff85
SHA5123eee6afed8c511b3a36381859f945c245ad2a681f56417b5c1cc8864bdbe28320ac2e16c9dfc397c3e78114ccbf24a869b94c66cf1ff427042336ae936354fb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dee0f5248a5d7a73b5e7de7bf7d26e7
SHA1c0900ea92c869d06eca51f0ea59581196fae653f
SHA256d78eb2977c18304eba48876b4c022c0fd045e2403b400528296b0721ed2da89e
SHA512810491d9cdbc3a5512d91ae83253abff364a7e33d7357d1339d1ab9fa5c3b57b824f73605d204fc85344ade000dd64ebef88cbc38705280294792f2e98697931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56458b21a3df767292561c3fe7823dc0c
SHA192e5e202a1d64e3b27ffd847f69cd368d860fe6f
SHA256d3c37963cd0f6bca36c76474914244a001b5a6572a774685ca88420d51c5ea6f
SHA5122313c18a8624d6baa95a307d86873603cd16cf301642340b7b278c62dac3869b451030ca8133bbe527e4ab28b319c40edab89565cbf9d9eb2c3f3c2e114e3ef3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a