Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
6a074c4ec477101669f162c703a0c9b6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a074c4ec477101669f162c703a0c9b6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6a074c4ec477101669f162c703a0c9b6_JaffaCakes118.html
-
Size
23KB
-
MD5
6a074c4ec477101669f162c703a0c9b6
-
SHA1
874ee73b36a18044e8309838f3ffb9743ef040e0
-
SHA256
9917f2a72d338492c19f31bfaad51aa5efe37f77a9e69c3a2ffaf8dcf0c58e53
-
SHA512
7676e2e75b2b027bcbe1334183219e06618d12501b9a98dbab1ea947eedf1faa937d3926a4c2476d6b8cbac966b76958e6814cffbbbacc4be46b72275ff3e216
-
SSDEEP
192:uW3Mb5n8T5unQjxn5Q/lnQie4NnYnQOkEnt3XnQTbnhnQuCnQtKwMBYqnYnQ7tn+:XQ/KiV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0323e1bdaacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4694CD31-18CD-11EF-B2FB-7678A7DAE141} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422607416" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ab89e591716f97933bd2b8a42eae288d7531dcd3ccffb165ac8040fefbe9333f000000000e8000000002000020000000da7d0ff1c741ceb40d86a84d1027b4a3173fdf44cc48ac5394406fec964211c9200000003a31d84cdd9a2c7853ea9eaacc4f0c3ab964fcebcf964eef76aaab3f6cadb10840000000ae67c27bb72941a9e62a49b4524c180bfb012f394327682475df581366066e0fab111bb778197ae60114352111e4bacd472aae00342ae4ae491709595e5ec4a3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000103d086aaa42f3335bbc93b0b96fff3e81f8a81af6189d919549cf6c5961c63e000000000e8000000002000020000000efb3ae21222a71e65c1e39c30e6a30fb6f165afa200a93f5e891d02b7747f9bd9000000077ea8f117dd951cfc2a0eb1aa00b2a600fd9ecdff463eb32e409a6a30dd7b3709d755a7b93d748f4dcedf477cad06601f04987b73e3069727c220bfa2d1a0962601be7fc27a0f964c6efb50917f25a875ef0c875b8e1c4512c36b179422f3e8384a3f4357307cf38ba390f0b880c795b5ce286bfe87c9029f9d0fb6e9c3a7e387a5be10dd9ca8423ae422ae52bc4559d40000000856f6f73b30d32885af1f606e12482f7ef6997598761db946f4fc799dce7370ba2796608e9c46e70681a1d73ea5b14a3b758876a1530d66d36761ce10c446180 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 856 2156 iexplore.exe 28 PID 2156 wrote to memory of 856 2156 iexplore.exe 28 PID 2156 wrote to memory of 856 2156 iexplore.exe 28 PID 2156 wrote to memory of 856 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a074c4ec477101669f162c703a0c9b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523c8bc3b63096e05291538d67e8d3b6e
SHA11147006b775ea62c51be71824b78dd5a8a6f91d9
SHA256434ba37f1e3e167dad0bf5b427eb8c68d2a8f394c520f4267ea48c59091f1fb8
SHA512168aa8bb3c5b5a393ba5987227fbcc699129f360cdf12758c10beb61b6fc9ff244a3c11dbf7d6e0b2d380aee1b15de27880b3c5906e100fc34bcb0efc2c7e3c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e02b36529a944ca0a012ab51408c6cdd
SHA12cef2d39df98b3c47dff606a74a4ec583f17e8ea
SHA25606af4f59529ef510e13e72124d39c49eb9f50b0b81045a935bbcb94bcb1ac584
SHA5124e2faae61fd258c4c7936a44f78f0e5fc1fb9b2fd8d73473f7734451c1e415a822497eab42382c0c883a163d08ad5ce143a8436912e8ee952b530d441b3abb2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597c5bafd0042eedabca167556bfac07b
SHA1c870df53a82baefade6a0e5a829e198d14201004
SHA256b5204574ff432cb10e5d15d56574633ec612828bbc72b1b22d7aa356a0bb2733
SHA51227be124f8c417e27deb92b841d67aaa345ffa00f42b7534fe29d36b2dab10adfae9f9609039c019fc07e3ca223c975a26be924b9d89c4627a888b84b9d3b024c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbac3702d316ac0e09e66d74273ce4c9
SHA1e924382f170d5e45d25b9fab1a7fab423f48b992
SHA256b9ff22f0b828fd0579ff3fc5818c8ac2ae004ef950162487445861992d416d09
SHA5127b9fa30408d8635413b81f123b9132d1f0004c73cbc9cd3e697af38a476f545baa9ca1e3ca5aed2109a7beaa6e4671d23bac1652dc38def96a2835bbaba8d86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538e6f17ec22a3d21a5b5c1fb0084aa5d
SHA1687c8c0ec106b30513453b506dd9ab244b051f90
SHA256ecc3b39e66166545e0b47b73feb2e6455ffd4ae964b06a7a01173bf714f58283
SHA51236167bef1379a24d34579f091746438a9e27b3a4d6abe57e61298af6e32ac92e94c60966479d4b9caa6c17cc037e93aec7f781a7099ca0427740e5bfbc28aa39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525f311479f65fe5cf2afdd58d3eedc0c
SHA166e821b1774bedf2013cc2090fcf6d80c44a9b3b
SHA25666f326482917bbbf3a5406c425ef304c798bcb50bc8c7e4497f23de8dda71050
SHA5121ef5cf009ce9aa9220eddde6934da083e5bd1cb4b8a855f036cfa67a0f10ad0ee81a490e27e19c344f8030b863d2bc59e3507ca397e2807d1b8cb9272ec3b1e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e1dac146fb8ec36e9a8e1f88568d041
SHA135c3cf1ba7418e42803eaa9724c5ed7b905788d9
SHA2562304e63889949fafc58a4f4e5f27842254644a49279e0ec69f492ba373d77676
SHA512a0cbc7faa7ff277197576d84cb5412f8b0ef65d6f6ad0e2735de7c7d3e77799a9be0920e5dd5447ac4ee83964e789f22bf839abce3772f22b7085be50317415a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5651e95926b640cce075507fb7aa91336
SHA17f89c4273d0dad09dabd25fdca533adc9ce06a6e
SHA2561c161fc5bde63389d1af807c9a08b0b11726c8db03589e511eb12850e2ff67cb
SHA51260bcb4cdae60957e4cabcd1a033102c918f8d0b41be82f35790eee577387a3ad82f11cdde0a3a00a9ea451f97e4d9a0402ab153b3d3fa2d9b24053e3baae83f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e3f163493191149a15881b3a2f42c9
SHA1e7cbe97ca8d555357ffda2bdce4ad7d5fc8bcd23
SHA256eca118fd1a8dd3a1a563fcf444a7d8ac43c94d9f43c185b60a7debdc7955ab53
SHA51254ce4f1fca7ad8dbe6d846b7840a5637689d9adf2aa7582220a547c9d7f1f7b26f78faed3bb7df520e91868ff0c1f4067ecafc58685212256335484fcac0b98d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc4073b3eeabc1b373d1a8f3ffc21fb7
SHA1eb7440213b8884b538528bdd33d759a0cf574996
SHA256750188a5691ca14d1ad2c0bd4deb6c6a729fc553490886065dfd34dff9e72f2b
SHA5122f8adc678e2d792c887047175dde771e6b10a58696eb8d4f6371a48d9ffb94e7b49b8b760ca1647ab8028957bae31c6235544351bc6378341e8b5354a64be7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f55e4573562561327b7357749252c2
SHA17389bdb289dd348925a7921bf0599b701f9a5741
SHA2560a9b7e1912a2a55c42c10ec202216236948bd10178592b605e920123b0c75cab
SHA512a59bd9251e32cf704d6be772135ce12768a0957ecbd80c259b4a6b3047109f4afaafe73768be6e7ecd48c78277a97e27877e0b2803d3dea51522e5c34eef66f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51135a86bb09f8264cbd47fe494d7b431
SHA15fe2d7a56096c4df841e05f1c78c3bf360f059b4
SHA25668d9b7d48be0a8dd685e4289e8a51b41c768a458fcd36d5a74f5f6c4129860f3
SHA5125bccfb4496c8418bef41039c10ebc977576165ead54b250177e918a04edac6279201398778c63b5a9454e9eacb3f63f6bb8923889ac2d06953f34db874d9184d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e9f8abf675ecd21197b69a5d67c4767
SHA1f7f6ec2f594b3ea74a16e9dac9813dd83f832855
SHA25671cbe9724fabc69767577c6335fd4fe144bc6f8663f7a0ffd65d73ca6be40898
SHA5128479cbc77097bdb2cfeddec1e63470690fa521eed5adbb5af9e8103e92468561082ada146cfef7733a2bd9c65856c03ce87e07b9b2eb0ce88eb1878f578f72b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541b3cc985697f8255d67140d761f3b33
SHA1e99b9427cbbabab32e25c40dbc3b3dc7dc37e1c5
SHA256fcd614a82bc4335ae5803d6e6717b712f003b5204e8e7a06215f7ae0ab8f4ec9
SHA512133299754e6a0196d461b3921f8faa04ec02a3e0659388759a8c12df281e7c916ff51c4d7eee840fa976bf0ae85b8dff618416fc803bbffdc7bf3d024ea789a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56124a08bfc2ab8a92df398f468ba1af6
SHA11b3a0f5afb9539ba730a6c164e7b25dc755346ff
SHA25618e04c57c4c5cb33c9aedef38ba0ce4a117d38f7ddc79dd9d210be5f15bccef4
SHA512e1bb3cad5468ba779bb5216d715553a815aee7a4a0a4869e0d6f8a2eb0464177d4fd82cf8f0bf1bc62821031822c2dda59369acd9aaee3983f3be601c23a8ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55549210223486aecfa222e4ebfe0c4f5
SHA194a97b20cb42cca9e73eff83afc81cab7b7e1557
SHA256258a38a8204da2bbcfbd2bb199148c72b3fb37ce106273bca9f295cb37840da1
SHA512228c4ba399a1e141d840b6dbf83d1a3cbcfdd1a008296251e42e553c2345df72ad3a4ca1c1639653a573d98d114dea260a1b8fcdd62e178b1b80bbaa9ae7da8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5543f7b0c29f4e3bf0f24fb1de0b5ba91
SHA1797545023c4c3ee8dad6cf90f3bd1f7966c9d483
SHA256a28a65f2ea88af2bde5f691ac25d31ef972c59ec517ea4e7352be5c3957307d9
SHA5122bcc036ee563416afe504f62f254695249fd5f0ca5f275eefdbb844a4029cf8d08e287ff65747a9faae80b42701f65febef6efab804d16512a831572a85fda32
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a