Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
72437a01da2e7c29e9bc2201b56d05e7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
72437a01da2e7c29e9bc2201b56d05e7_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
72437a01da2e7c29e9bc2201b56d05e7_JaffaCakes118.html
-
Size
204B
-
MD5
72437a01da2e7c29e9bc2201b56d05e7
-
SHA1
f9dc2e43445b409ced50a1bafc9f1e5941b76f0b
-
SHA256
3c2769f1119b5858e0b063e9daa3a8044c27563b6a2e1a78c32ee7fd9fa205be
-
SHA512
0d5fb0f8c3b54a32accd452398fffa167e7e023fdec8f904c3b2eb910fc19a6b3eca0267de63662d310498074bb398a3cde505427e70e8304b57d184b96223d0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000051ea2aaca725d9e5960cd6a8465ba19381941607d864abcd9a3f524b9b50053d000000000e8000000002000020000000cb622f441c91dfff6b3d62ac94e7cdc4b87664b4058074103a940f6a740712d89000000081dd130782af23a1abda72850d877f6b99d8c5944b34312472463c285459450a0624888871290c374f18f196541c67b50b723d9dcc359c1e068db52e2cd8bef645799e57a9a22c4a573b23a962522945761db32c5d37d3b8c0577461d650b5a39747980e6e9c8487f0c53342109c9900cd331bdf83ca22b5d3b63c8e9179908796daafcc8dc6ad4c167ee6293b7690b140000000913d87ecc3d66142ecfaa23562c2f7b1081f9743ac9ee46e8fdb1a2b56fa2df367f67e4762c0b276f6cc11c8774fccbee871311fce1d3736211c521dcfe21ec8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bced84406346ae01e26a86cb4957c31f74f49de627c79699eb9d0cf5549500e4000000000e800000000200002000000080392d97cf7cc439bd3e2ce81f6d43f57565d184894a482849c3ddd0e76be94c200000001ce097ff421f5f1340468d4e83471552885d22590749b19bf9bdad7f7d1952f8400000002f155994de282390d5f802615ab95dd9603c8eb595064e86bb705cdd461dd2c9b9ace903d9403d4578d7a9c34b9da23373a40f23631c7602cb5d37eb57bc0caf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f7c01db5aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{492E84A1-1AA8-11EF-A1BA-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422811424" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2920 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2920 iexplore.exe 2920 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2928 2920 iexplore.exe 28 PID 2920 wrote to memory of 2928 2920 iexplore.exe 28 PID 2920 wrote to memory of 2928 2920 iexplore.exe 28 PID 2920 wrote to memory of 2928 2920 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72437a01da2e7c29e9bc2201b56d05e7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55389cdabccd063546f1673c63ddddd67
SHA1db8d3c23ff65cc2d401290b20ea57d52ebaedbc3
SHA2565c1c07d1b910105cffe8145c97c78cf2e6a2d1519a5c30d059112730eae27442
SHA5123fece3917fd7c8de099a3eb9ca26e4f74b8c1658aa8260238370806b36a0fa041875c6b971ff0493719488ae1db1e4984fc1a7e8b82ccc8f85e347307bf4118f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b10b3459c216b5826345d5fd3c8cd94
SHA141553158b1ae02a6cd8dc07e05fdb41a71b982c8
SHA256755d997d1b755027025e3aff1d4fd389b02d21c3425ce46896b2d324e432c75d
SHA512511c5021502b74bf10e98bbd3093f3e1dd6cf9c31d9f7589f60995206b2c12a6a748c9b033acf169526fc5d3bf5458f314af239da23ac2785751c6a476359ee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d615e3b018187ce2efd7e6b61e9f26d
SHA1fe4c7debc0b7cd7fc0c63dd71585c85cf6d557c9
SHA25651e1b57bde6d34b1fb5f7f8dc9f3d7faad54511ae5d94479709bba6adf164a2e
SHA51265f65cabd66a2e4e2f2c5ca0301d4347854afb65c246203dc9c4f6caf386f2bf58196ad7ce62e06cdbbdca72e2868bcd0c5fe5355f836df69183bf927b895648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ee8b11331793bdd7f744c4e01a45cf2
SHA1c2d8692a1bccbea6b62dc62560f26d2608073cc3
SHA256c1cf9668935ff1ab595981311ba0a5f24b7b3a9576ab4194458ca5c1bef2c997
SHA51273b04673c19028a962a4cd14ec37c8ad6077d8c27a7066c54e7036719f7ea49bbc97bd8b892dba2f4ad3dcf2d26d30be8f74fb245a29b988e4ed09432fb58d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e6a7c212888f7ab78cf4d1cab8d277a
SHA187e781bc25d012a9980f3bb02ee608b0436cf7a8
SHA25648ce3f7fcee99829a7a271ae432effecdc0c079c82d2e3f9730983e705f8e802
SHA512aad72b517f4ec4c8c43759735babf1db864c662d9db3a5a20de7c9b9e0ad8a242fb3c64842257b0270804d25413d84ac59af51cfc7c76f2e739276d8759b12e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a776c0039e9838b1bbae663929218071
SHA1e5cbd88c51fb5951efcdffa468ee3d893b4c62d4
SHA25678e7be339b4df1cabcdd0df6f3ca6a69b048ccde3ffa40da9f3755e4bffaa3c2
SHA51248876c9d9d3c04046ff5483a5b9aedf0eac58e92ec86d082f7c402aa4133648659544df2499c3d599436ca9562260cdd08c2c5ff540bd5d9c9b6cce6b8371f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5fb8a057accea1b29165866c491580b
SHA17f7fd190207e8581ba7969b62f3a109406f764e4
SHA2566753a07e751ccd48873bd14eabad9e8a5b44c5e05b1a8dc728c7833f06e54fcd
SHA5129dfce47f42158dcaf8c882563adfde039237c770375bb6e78e4c3709d8cd2c5cc36a6dd8eff0d0f81a07d9756daa37d0f1247529f3bd7857a0b41d2cf4959b27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c96330355f005fc6568899e90ca4004
SHA16830cdc8c0e17701cee73e07ff97b52569f10d55
SHA2563ffca1e862fc564276d8cbb0b49d120cfaeca61131069ef99c39e99b2e8decdc
SHA51247c359ec3f649eda1ea32d1b040c3fa3c38f2e937db63ab47c1d7adee7ece9258de4a315146c629afb69c608eb00d12cf67060aab23b194aff84578d14e7c319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55391888e31bde496630bff524bcf3d19
SHA15dcaa052770034b02acb19aca6ba08cf2d5dcf8b
SHA2564edf4352512cf515134e58d336009841d1127229b29b6e7967bc7b85e533ef1c
SHA5129d9adb96321b79bf81931e3cfd9718e619c23ddcab086df328f779c8cc2ee610cd01ce11937c4908ec1ee362cb900faccd497bdb71195ccbe96ba354acb742bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4bf2e1667a7cbf475db264bc62a3c06
SHA1476e0511f35e5491280a620dc4f26f33b8c840c7
SHA256aaa9fc3136a8e9849c75e8d424bd7f90508dbf72e250cd144629617b8de74212
SHA512be138d5add762e2a9cc972a429ad154d6c6a07440919a46d1ed91e358e6d86cba1920fdf2fbf83883a839b6c45a5227ccf04f26091a97b44ac69dbf3ae7112d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5153ca5537226d264489d503d3a01a4
SHA1fa4b0113d530f288f49ac428c2be1ffff53a2fa7
SHA25652099bfcd492377335dfbeace1935e31ccc0ac17dfb5c8420617fc157859b81e
SHA512b7b8dd2bb3c0b021aa6e537de3e002950479b4ba1957a8a8e4794881ed3cce2d33cecc6cdb72795f52cd56da6facdbd19131416a46f1415d6bb1783db157bc4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b43de577dc8b697bace288663292b28c
SHA15cf5234d06b6682c4be7e9e5b473dc57080479f7
SHA256c190a435838c75e612423675a57fa4ada0ef72b394bfbd3aa117a9ba27089182
SHA5123a3edfe8cac5e541bbb591dbf8040827891cb50932cf3ec84d0d5c4b4c88240c6bc5a20694e8b28f9d335f332ea639853dae2dc4f3854decb0318aa9a2124f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fac90132279abc471122b275c67cb0b3
SHA193952533e0d8d2045370eefbc5834d1189b8e362
SHA25648cc8cfc6680f937c4ed3fcc860053b7b16e78a94a601af1535a0fd09c7fd136
SHA51252b9ae01396e5436487a1ea536bbf186ae66fdbcf26f843bebc68cb40cc294db4f01577febfa2705e6f7f7e1a6a7ec769d2824637b3b847ac3ce7ef5ebd48cab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5317ebbde35b0cc9afaacfd672bbeaeb0
SHA1d50f86b1737b06ddc485723901d13d883f592c48
SHA256c8d355289d1bfa1aba08d698fa6258b33e42a39d6e13c0b1e2901962f665f450
SHA512aad82d5eaea4d4d27bc89c07b82fab9b9e50f122d7a1f2e1cba3e17d83bd18b7e357a257474d7e464488745fee542494f251c624e8a69fc68c2f0b07cf1a4c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df8e1468dec94426f52a9748d94f9ddb
SHA11c375c3f2cb50e0eb1073658c6c2464656f0c5b4
SHA2560c45e69c7e3e1813329985352e495288477e635a0d85c1c9627edd4c34f03817
SHA5123337cf085223bb72afe787311a6cd5bf4dda1a7b57fcfda7d00c1d4c9fc15105b93486cc4c67d3979e5356f3357efd786d878276e01dbcad4d6fca0e16aba2ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf413ad234bc567c257c44b89c8471d
SHA18e98fe2c0a6a064a1992d94d22b872d61ebced63
SHA25679080e656793e4aabb16e00c633ab9a5803dd507cf379fad76ed8a9a2226ce40
SHA51279f987e1ba5b02ffe9b893d617f30c2e40bd9343b5ed0d6be6352c98295a167f8bd30b3ba682563fb10c0fa3f7a252d80a54b4e541a0c1a557a5ba2da852d640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59723f953747647c52f34a00869eebe28
SHA139c52e4c6aa60478c25e26ed8c9bdd36023bb928
SHA256781017ed653e8c46c156fa3ab71135b4b64757aa48945b1be6ecb182fd874721
SHA512f6729dc40bf3740f80598635cc6c84ec6858726f505725b5e3c4beb7c96b4efc3c954c9e03b6ff582ed34461eba835455807fd934f4c078b7f7d2e19ff07cc2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c82153ce964e73ebd68a62abdda58b2
SHA15e37e7e0ea10546d60f9fef40e3595d5f9c42797
SHA256c9528d365ac90e9361be9e926e0c8d1c519b54276f750af2d6c070f1cd31a45f
SHA5125cf24fc6bd88ed30e04d3865315c4fc4eeb2cae2da04c4fb74646ca801cd1869813dd844874895ca7efdd1e5e2de65df318d862f46ddaf08bf0b62fec228e267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b4a3e12cc0498de3870506dd25b6620
SHA13a34578e61354067dcf8d48a29539ca7f2c5359e
SHA256f423fc71a9dd10377ee71eb1bcc7f2b11c43a3dc6527f83274987d3b3b5bf4df
SHA5120fdccf60170e1501eb0558f25d5eac8db071ace99426d0ee705198d6aa0b63e6ce570ac5614f81555eb54a59520e4d45942bbe883473c132a4029849fbadf623
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a