Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
6cfcc4b3dc1b279f096c498be589d077_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6cfcc4b3dc1b279f096c498be589d077_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6cfcc4b3dc1b279f096c498be589d077_JaffaCakes118.html
-
Size
483B
-
MD5
6cfcc4b3dc1b279f096c498be589d077
-
SHA1
2e74a91fef7fb98ddf81aa4b69aa4f9148b785c8
-
SHA256
3597e93c2df6162d72f4d745029f25448a6172ad5d9080245dab21fab0d3aa28
-
SHA512
353f13dcd33326b60c7116c87c9ada53c43a1d0e257ba6bbd02b5cd943b46c7a21b54ae20ed18a70d7937a3b9c837cc6c637da95c0affcd1b9bf2ef82acc85d5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097d6e6ce08c068428f83b1855873525a000000000200000000001066000000010000200000008f34518d3497caf48cab2fcef2cc51c3152a66a57144a1f9d74b4a0d59625ab6000000000e80000000020000200000006a3f780f3c3f10b3d81b67c34a7f5b04def5b4b30e4952edfd7b79b5f97600c820000000c253616ca2e898bf806693759718218bbfce35c8a506ef9b528d3a935c322d40400000007af0f9be748ad505c21a296251191c65d2620fdf14c6a273b0d86288212204274ae555749e2ea9ceae353d24879e20c550fab70b7f0262724541714e0a7ca727 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422677512" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097d6e6ce08c068428f83b1855873525a00000000020000000000106600000001000020000000482bb01cac2ea9c32036d76823cfbfb8e052f7488c3a883e3c02fdc9a7296889000000000e8000000002000020000000a8d20394b39e4571f232213158f30bcb4c108c4f90fd12daab81308f0e5a363c900000004eb3c3b9078db461cc67e09cdd7e707ccc8d6b69f5cc4ec12b543f486754c1b0296b1e590292076e3c206bc0009c1a9998285d717e1d242543579c9882f7ad6457cbc05eac239049fe949c3ae1b48d34bb923d6e0cc6dad91ccbac08b4c4dfb8ecd5047a9e32a859fce17098bff45f82d730da1e5903917ca7cf29c54dcdb679648246be976a5e6683bbbfb076095bf140000000758816ec3e093e33facf914a3e428b4d1bd5ea4ec86fefea5a8f6578b2bf9d6b0b5e049ca656a8d864df1d3e7a487a9dc56178ad524c2a41edf65add1987d66b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80687E51-1970-11EF-8DE7-EEF45767FDFF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fa08557dadda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2476 1968 iexplore.exe 28 PID 1968 wrote to memory of 2476 1968 iexplore.exe 28 PID 1968 wrote to memory of 2476 1968 iexplore.exe 28 PID 1968 wrote to memory of 2476 1968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cfcc4b3dc1b279f096c498be589d077_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ad5c9383c0d2db9b84e72e19a75d841
SHA13f104d12f18e98acc091e15efa4ae40bbab024a5
SHA256fda406b81eadc474d1a84cfdf76d1e70e6a39d5c3fd8d0ae241438ac1d8d25a9
SHA5128972f6d4612ad4be0a50d7bf9fc719aaf69daeac48849a4bf1ab1e8faf0cc826337051d0f044537c166779c61c6828e26e1664f35adc32b0339f62562583fcf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc4e31e84c4e50140960e03e0e1d9832
SHA1c8b91b1fc492eccb2561b2b62587e71a0f86d57b
SHA2560fb2bc0e2811a7682a9ded6dab949d65340654456729da258c09618218e08055
SHA5123f0a85de290c3214a0c66b379701ad89623dbf8054131bd866c2020862b4337eac11c9faa36d4222ac27f725520ff638fa5dc1d1485f00fa32a7a2ba717f5874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0ec5f5e4efb1db9324549e623b0388b
SHA175b3b7bba403e6066cd3fd0ab1dc798142f920c4
SHA25602006971ee3ca41d72cfd4880134cc70ba1e082adae65b484a2afc0566328a9c
SHA512503a4ab3e266e0f188504fa2cb6ceeefca596628d4f7bcd5bd445f25175e534235cfefb55a31ba9298e2bbd61b3e2f414cff4497dba40bc36017cbbc6fe08873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ece4b9880a8930b52f846e37d3b94d46
SHA1839d48ecb6b636838b6c38fe6b0128d03e127445
SHA256180074150e78759fc98ad98ed627ef718343dd5c1080b8c292383a690475793a
SHA512e0daf47bf4ac4fdfeb6c68d44ee78bb0ff9f38bf845439b8e4c7de91d1448c01c69ba31a0f464961ec51429869a1a7926f728fd4a33f6d62466679c90a5f2905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528fe9f749c4fe94f2e12b9d089e5dfc5
SHA18923fa7fba8fef2532957581de31b05485f07606
SHA25632594c5c48934a718f8efeac0e63fad4ff5c21d020f5f78950bdf34e5d8cb60d
SHA512fb9221c90237f3bd93ff2e51c4219e278414eb0fcd713540c07b62ba4ecad5fccb3372dfb02927baaa561a1127fffacd64145277c7d8263d3e639277ad2fed7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57caac9471b2adb6f5bd188fc124da3f6
SHA1d6e401dafe706940e74f958b54a2756d10da5e3a
SHA2565e0b728f9da583a11bcf5e50b822240642f8eb1edf693853ca553c5e84e289c6
SHA5123a4b9052137f02692266791f3cf87b6251e4532d0ffa74e58ca8d9f88ff365658df5c5b2a6fa8759670938c4011bb47781254b4468ee317df850fe6d48889ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f16dec7f5a25763627bcbcf93664124
SHA137cc100528f25ffc1f36df47f90447a148075f6f
SHA2563beba014d0b80ad030a970e1117d186fc050bdf290ef289115e24f2fc89d6a29
SHA512f0be5fd1112a894c242eacd508d4d75dcbbd06ef384d260874a583eb895ae12ece98bc870fd433764bff3ac45b3fbe4a1a525b639153d77290b87be42f103a11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53207955adec22720cc2089bc43ff6300
SHA1de3dc3a6295a0716604405d0991eab6cd6562d48
SHA2563f18296785091378258c533dc4f87f04f7abc5a239b76e1464105fc420528d88
SHA512d83addbe3db15948f8dde6a61f6405b00c4e29dea8bfec5b1fd7fe6aec567354212f462de37975db610d387162d67285d3a7e3ceee54038d6124991ffb83e083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ec4883d7d73ed75b891b8f6eae22608
SHA16d1c5bca3329704b8241a29a79ac6d9a4206c5ea
SHA256b613fc97b96a858d2529bfe0a6e417f7e064c3b438af1c653cc825a712f1594c
SHA512489b120bce6f12880b37590b2d4658f7066eaf2a360cd3488cccf3dfb1a77d1f55979959d65092cb0b7495a1378bba443a64d3d0b028ffdaa0c511a87ed8ad3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51172329a2835c7c284351d0ae7ed4853
SHA115457ca59dd3e093a43eef4dc01dd81045bb9c27
SHA256c6164e901bcf65c12e4fd458a531b9a4a8229bd8529e5b31e57e805aed33b758
SHA512ac12824683ce6546037b13a3539000598be24c069e07eb036d00bec4504a24cbc8242ca0a6ffcf48bc3f3d3d2505f203b971b0fbcced31c170b15549da7130bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536b374f60892695fc6b3f0da7462c008
SHA1d15ee5a1c52b647537d401fd61ba556b0064067d
SHA2560cb5858929b02fccc08d3bc1814e5e0f74cf1b748a4a1b4aa0148c77c8fd2962
SHA512ac66372a9fd365fd768ff20c11a2cb51b4c571cfa906fb4af1c1aeac5154dd7720b79313ba6fa7fcd82018b4540ed4c1cd9631f54c2ad282678c2a1091f52cb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59512c8b33e3dd9c3945f06ddd7181303
SHA1b1ce477e023afd7757b7fcb1f02cd93469ecdcce
SHA2561583724ca9d03b66d685f09015175ad40fd01a949ae0d19593a71292a7b68292
SHA5125263bec38c2332e292c5bac788797d3def6e39fc5cb9245993241e281f9232c78a9b2df17d876b474c5b4d285719bc5ccb9986b578fccff74ff52f62319dac7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e083091dada80f4ba2dcfece2fcbedc
SHA1d8bb01605cf91f9465d39d4a17a2a957fcb33cf2
SHA25617c1e6c83909244563ff783e8bd981f5f712dc87b9b1b4de927c830243d56f9c
SHA512c20001b52b57aef64cdf5df9bba7a9145a631087e81dbcdd5d092f005da4846746970f06dfa88bedacc5ed095554a29457626600f8dc4c651dbf172589e2ef8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5d0aea3f2ba7522841f9269ff107f12
SHA1b1df8d751c3ff481a7c6721edbd844bbb86508d1
SHA256b48c20b5d7eeefb7231c2419803d7ce4dc6e70f434e9f7f4bedab8f31dff9aeb
SHA512b04c23712e6846eb91b640fd721660ee55b6bdc7892e158b848c283cd6771555d6f3814af764814886a7927fe1b0623921968d4587a5c061e2c9e8a919bc09a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57898cf11641882e5e640bd7d36a0b02f
SHA1ca8d6344919ea3278d40399d081544f936efd6ea
SHA2568c9b2141ad3ccecec4d03f3d6ea7e4cf526dc87219b27ceab33d622d91df2eed
SHA51287617d914d565e3b1eff5f1d02f82c7b3f3a642a081a706ce33476efd902a819a41610ad7ad2d074c4ffb420faef6164ec86a4c25a38337678f031877f15d088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acd654008ce8d2768c26326ddf96564a
SHA1f075f654078b53ea7608ddfd57980e7494ae8bd9
SHA256f53c208d736acf779df3b43640a28b76177b35f835638f3e34847b566a202c76
SHA512d243c6698538b4a131dfb7536745737d2be6e631bde74fbe57c2beaff6706862a8ff57ddd04563e5f26933109a7b2f412a476504e642886170837d32ae838ae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e83e4727ba98e8869a84eb632d6dcb77
SHA1062e1bac86c78c525f92f9d998ed03e904bb5552
SHA256d5caeb9819b54e476676877dca3d359789805c8f562eaf137dc8a6658a4452b9
SHA512a9d56ed4ece0b70079807f1ca90159e498fa35304fe2b85f520656a727e66026a7db049e7c8d76849c2d7bcad9b295912fdfe127681346f40f8dfedb27da2c07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dcfd84ed7d2862f6d58a15a0d495cf5
SHA169e466c7b30d1c1697b1effc3590578716798e0d
SHA2565d3313d184af6871977df66812ab6900e211895bd933499c4d75de5fc2525719
SHA5128e7c41c3eb2af1499af6c29ddbb873604177d684831f34c36cf3fa4f22c0437083cb463781de33fe979978780c09ab77e3355af822ed7f8abba5ed17fdf5a214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5511bdabaafe86b8b51d4f6a0b337c5e8
SHA1f9da18a18cca91f2368ad616262113b8ec16ff16
SHA25671cc81b745a315e5e69c05ca51c845774c9a961751ac76d29ed1191fc83a3663
SHA51223b120fcd78d0a32965b8a8a03fef4e5ea70b3cbe60125b7843169a914b8e5129627742f6fd1a3a0794fa2482c996368ac05da9bcc35b65d47fe905d9604c2fc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a