Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
716390ab2d988dc0c69fe41294f33929_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
716390ab2d988dc0c69fe41294f33929_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
716390ab2d988dc0c69fe41294f33929_JaffaCakes118.html
-
Size
3KB
-
MD5
716390ab2d988dc0c69fe41294f33929
-
SHA1
9f90375ea626cc4a532bba16b15d89c71c4aad6f
-
SHA256
6eac3acbb6f4a54b253a336472d50e5b1627d9a551b11e2a3289de71e8d3315d
-
SHA512
c682ce76e1128ad8b3fb4d250d3f0b14fbb557b8f49118bc1ae72eac2ee758c061609d7aa428fd874b089228a4dbb411ba9e14f809007ecb5fb19122d53dfad6
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000837c2bca7bd564a964b8d97469cbc56917bc64451f9b83b1741b5a0efcc33cbe000000000e8000000002000020000000945e3864ac412c4847d4bbdaf712c48a79e45d8ab22d4364558bae50dbf2893690000000bbae2e77a94f8e1a7e685f0c4357490b27a3bf4cd5d21ce880b12c66f8d7da8971df9124841490790e68426289ed4b4be4a3c831b22b1f4a2cedc43be30aac690e7e463aed1a4b6e628dd9c7a5392c7ee9831d575414d1179f8d9d8a4f0005cf68ee098dbe7fe0ebd6f9069e1040813b0166dd94bd7f095af42a7ad8b00012310d09f2227bf1cdb496a3309a358fc5fd4000000056f7ad91838fefce3cfeee181e72e82e9e40732d9bbf4665864d186846ab8b2df14c7535f45568f1e5fd22a7f54194e8a1472d38dbf90f0c6f4ae3c9115b4cf4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000dd2c0be85bd5a895dd3a049d516fe6d8a50b9e845d148aac1cd0473802b61545000000000e80000000020000200000005aaeaea6494697b2245fc2216b920a9455bc0c26cc4de9cffeba747421bed7ad2000000061e871d2e31ed88c59c27dd6b97c657b6914c401b75cf108efe1d36e4eee72c640000000cfb0cf382ac1d672ce46c51e06a86bec5296d89fb19eeee8a419b7384e5f942f000ebaa36d16d6b790fb5cc8d4bb22139f7c65bdcf2970eeb82ae05e93768540 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800f19b37daeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE7F6161-1A70-11EF-A538-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422787621" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3060 2148 iexplore.exe 28 PID 2148 wrote to memory of 3060 2148 iexplore.exe 28 PID 2148 wrote to memory of 3060 2148 iexplore.exe 28 PID 2148 wrote to memory of 3060 2148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\716390ab2d988dc0c69fe41294f33929_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bfa524b63eb29a257f78e2b48925ccb
SHA1292548145799fc5f9ae6119008b89c333c558a5b
SHA256a9b6a22fcaa83679f688fd401a3d84c740d3747ef46ce9df2d11c423789ad592
SHA51279b85d77dc205fb3095957cb267130994c41aa789a7c8af50824d8845f1dfdbc3638ee44e92c73c8781fc7ea935fe7ee80b9b626a2a6051cef60391a6833a5bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8e02482f58301883dc92ca0d831c709
SHA12444e7a6a4ffa16f12df68b6c3dc7427b020811e
SHA256ce3ae1517652c31f448d4c24178654f233b258b3e16ed0e37a781d9571959597
SHA5123080adeb70bb667527c8fc30a163b9ef681726feb1d8b7d49074800c1e6a868399d31d0e6bb8adf719a0716fe442a27b798d6ff6d0557ebd28b281f031975a00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54291949c5324dabc18dec2ef60903426
SHA12455f5870d3c1edb83fcef521cda3a7b769c91ed
SHA25632718bb6675b6da964b9fd18711c85d936864bdac4d40a36d47e7542c8597602
SHA512f514e68f312e8fd5846c984064acbf91073d307259016693291149d51d8d88b8018c477f7bbeee8d5188cb69002904ac5b3df0f0f5fefa715d24e71ccffe8a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b686e8ac8a5291e26ab373d3e36c967
SHA16d2d1f0d01b514ccf80607862b9fd8c88ff7ff10
SHA25612acfa0ff81462b19d12f90dc0836314ddea7d28c9035b87d19250d4c5d71915
SHA5120aaeb9296789b0086bfd764a767b606195db68b22e99e603196928378b47a913d35f93f90492676190978333f40c88bfe03716307e77551b5c78b3dac7e5c8d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553964f9953dfbae8c747e5fceb3c9280
SHA19baf5802bb3b97c637396cac94b79d585fedf362
SHA256bb7c342b92378d0b3776de66caf1c32c8ce9e564e3a6149c1307389fc5d11619
SHA51246feafb61f37b31fd82bd447b4be8e3d7e67aaedd587d5148798f34d0911874d157914be7ccd324e23ef6e74bab9941b998732a143731ac50dfc7a4cf7044e9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fea884dfee7048e9b25651ac74fee75
SHA115a2c3380f7c8c98772afc86625c614722b36a08
SHA2562e1a8059ef393f6786af735527287d013162cf7b65740abe19967e9c5e868abe
SHA5122c3c93f45ed05ef4dc94cd67f2fd97b4aa9549701eeea6718c7b8e3691fea41dd109aa3fd2ece19ac7a38c18d14e5c1290286e9fb83d079c288b53f7738f2caf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0257a665ec6f5751df9637c2f0eba49
SHA12a4c6ddcc38324a2c7ddce57abb5de40af481592
SHA256b12b277832347f23d7f547cb33978dfa2ebb9d6d2591486c19e797fe85bb20fc
SHA5124bba2f3e4bcbef158c6433a061d8f3832d53c982d31c073a6d172cb0a0587e8c9fdfadad0fe575db9b291f36843b25571d12cd223710c26b482724d8a220d062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5561c4b8c198a970932b23c456c0bbedd
SHA1441cff58f9df58c4eea95e0ea593736bf44ca570
SHA256628e6d129bedf4d4c4d695735bded0e582084c81927dbb75b541a923d181620c
SHA51203700dec4df8fd00601d46303bd0ea34e0d8b1ef20ee0928f82e56c0dc92010a63543f5d9a68f61c56b7ba3fbef50bb1eb50f158173d7a0d271f7fed4b6e9fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51033d9622870b8311ff96bced204cb54
SHA12af9a8407d2d47bcc99074284f97b6a8bb997bcc
SHA2566057440b63ba0acf694d79ab814400c4c9e792f2980c0246a8e188f242072c51
SHA512fb4b10b105f23d67abb21349ecede42e81662cba8f9fdc68e68ad2be074f0ff4a45c739c10e8e69f902ace4aeb0a08ec8853fed3171ef234e551dee3c41fd73f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507d99287ce653ce76c8555e0391ac168
SHA16a5a728db48083e19ead68fead52893f5600d7de
SHA25695c2753659587c221fb7179834b12c234819eb4b73cec3822243d459ed51f860
SHA5127a85c77a17f0da705a7dff2f7262b13d05b1de3fb3223e8ed050203650bf48122dac074878b5e183a2e7167fb1def9683240706216380e8d566ef44d2b15493b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5946672eac2edd595057e31bee937dc76
SHA14a42b4ebf335045049bb54db968911da50f9d3b8
SHA256ceddc60951ab81a471ca1f61904fe7847597e135424c3f62d705e0147c306c17
SHA512de0c4ae3a76f21991267756befdc9578240ca6cff5e250c80b66ac3fc5eb0fb03bea110490ca2e9969d52d1c8e2a7d3f2abc63edbb27c8fb2a9bf711b7f6d1bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591795dcee4ae8706c1a59bfdc2a47e16
SHA134cb35c7c9a519885e3d24c43c666a293944c944
SHA2569731a8e3242b8cb821d9c7fc8ac2e14f6b1d8143c0d6c93097a589460aadb8d0
SHA512704459cd46cccf32bed8078c0ccfd859e0358ee064156fb1e56c2e876087b3ce8a05df92a89047b089c013d7b772a537583059a7fa7ec38fe4e47c6c4d1506a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f38959383a868c7d011e45ff3a547ac0
SHA167ee1ea0764ed1ea3d12914ea2eea700df6288fe
SHA256b727d2da85a126b0143d3601b773517df12a6322133f6da2757cba3c0c7fbbb4
SHA512449bc5f5c2f033e65b2159a6837f811f9ace70f61f23d76761647e2c8eeacef80d8cb3ee6152e56e0e07d66e3a632d4540c253ff104d10a16b25e2a41d11761e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de78d936edf43ec958b614da953a3d35
SHA15ca4d056fa373f60d5f3570781746e3782ea8ab9
SHA2564a7c8910013a307d4354656a7343fa3a78ac956bf38ac206a9c56784644fc8d6
SHA5120b1deddc3012206581b3571791182d68270bd7149399a10ccb1b631d2d8e9c86bcdc4f9608a55af42fb4458ae34c7e2ff134c8e020abf9afee34072966403a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc672734e153cbbdad1a74b450a5ff16
SHA1ce69abe4e9947f584368fecb5775bdaf51f42386
SHA25685394100fbf0fc0a54c0de9b5972a2006bc8d1bc31d122b9190d6191123342a7
SHA512f896c71b0cb9d73fac7a93ec540d3f0748cf7d65ecab04f5d3d36133cc2dafd8bfa17f73b4d6689cacb0a5bb5667f78ccc292b6e7c240b47ddcc3301506ff16c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae69352a5d017f0afce0b2a0ba64c94b
SHA129b01c0a5877dbcadcc5db82854da3d290ccd463
SHA256344aed32d874b1a5fc1f2840363c299ae3cd104861ef4108f5076a8ef4a28224
SHA5127e304390eec1b33e0961c1c90b625cfea34c5d6780c601daa6259d848dc950235fc54278c72e9e846f83ebab1fcf33a787f2d1b7fb3afba7d83d0addbe1448e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f049c01bf94c50c4b8860008aee2c59
SHA18257fac23b019e608abcd141735884fa1809d291
SHA256c27fed8667fd52e5a9548b7b6661544fda50e8247d344e8928bed716a1823a40
SHA512393e06af8704a17045ad75ea96b36e00f91f7821f182237bb87d5c97b10bd3c0516fac929e421d581b61a0dd89f31ab37b81b832c8933a2b78241844c85241e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dc11994eae86f32a2132a2d362b603e
SHA188e73ece22a313f8fc209742498f87229235a8d8
SHA2568bd08c948ced9088a21c5e9f49e5421383fdcc01cd1ad3c1994046bb895eb737
SHA512c178f65397daaac3ba87a6f7f93ed0b4f4b89a939957f4621e20f7255e24bf1a3ae3b224fe6b4c8f16a3fe7f8ac513623f3460c50d9007568e00dcb12185e984
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a