Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
7876da4937ae3e26fb80690917873148_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7876da4937ae3e26fb80690917873148_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7876da4937ae3e26fb80690917873148_JaffaCakes118.html
-
Size
760B
-
MD5
7876da4937ae3e26fb80690917873148
-
SHA1
c909017934040f7563426a0431f8c41ce840f6d0
-
SHA256
3a573b8b3167c6d9ceb5538636d535dedcf971f28ae4aa80137f5bac76b1e8b2
-
SHA512
1d801c5ecab90309691c9b3c3ecaf4f4c90a6f28047fca26d3d4ea22fb16156f930d7eaade59107ffd0f3ee981a7c522f2a269b4aaeaba3535db2c1dbbf85901
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0576b320db0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000782902b5dda1bf63eba111de38acfa2a4f5991c515c65e18d4ff671c8f551eb2000000000e8000000002000020000000edaa9ccdeb8511f466497a103341be57a436ef857e53f15fea63567c1101df9f9000000089965b91ca969b09307198e11ba17cf17d15b8d0d5d4059a22d1509a6b0cf4c8a78950baa10385de71574d3e07e253af50da3ae7b452cb5d1f636c823a6a8b2b1da642010e403c6b2d1016dc288999c77c36cf47c3c658e426ee5d91be5cb28d3ff1efde53580bc92895a6821eff463bd44a4a1a84102a937eac8082c026bb984770e9cf88c06e998af01adfe7f27f6340000000894c0ddd745b5101010660b5d3aa1e85b588fb98ec98199950c814b4a34fd4059afbb99a01a776f3c91588882895419c31bfc5dc33c29b71319b428d5c751ca1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000191d36c4cb9c161e678352fe2192ff96fe480b795a9d8f9b57223ca9a232ae8f000000000e80000000020000200000005e3e75d10338f6983a0a5fc56cf28be2faa5f56e0c9d743a95d44cf042867e3420000000cacc468bd29582b103d793dbfad2d45f9c068361c996c552a8f8170783613d5b400000008690610f7e171a52ba202da8f4a8b4aa13f6cca3de1b8bb3de0eff473421422afa6e8591c2d3b3dc5b329b7f5c6f90a5d6a0df0f8d525e9334e5a64de867becc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C3C2751-1C00-11EF-BA3C-D684AC6A5058} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422959228" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1088 iexplore.exe 1088 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2816 1088 iexplore.exe 28 PID 1088 wrote to memory of 2816 1088 iexplore.exe 28 PID 1088 wrote to memory of 2816 1088 iexplore.exe 28 PID 1088 wrote to memory of 2816 1088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7876da4937ae3e26fb80690917873148_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3345943d29947873e1df0b99629036f
SHA1861c14038fca8643ce437eb328cbf534b1dd7919
SHA25699e4cfa9bef4380d8eb7178913bcfed92d8dce7c13d50ed591d089d03615f132
SHA512016e59d5e8eaecc6203caa57b6db91f33a32da57a439dc180049f2a014a5d038b0930375a516df513778d4084c9e70acf8cc4cebee846b03b7b45e4fe8d95cff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554ad9e6b8db6d0311960cb4921b79f1b
SHA18a910e1e8f76a0b8c63a1ab4d3ba63305deb9f83
SHA2561203e7e9dd004590103029e2707c58da5b0d342a79eb5803fb8abda3d8006f3a
SHA512a01308700bdd5f3b77821bc8c100e763dac56ccaa31923b55af635e06f875e3e0fe8c778a84411d6debf473f8a0aa6dbd3acf1b4305632df9b18c3f35f43a16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6b8fdb9931c305c7294cf690609a090
SHA13b1b43918ca8f7ee10bd52935e6b8a14204b1632
SHA2561e41ff496d67aee924556ad69b1cd45431d70b05ca251c095065495df390435c
SHA512c354bc5440de1b5f7c14215087a750adb68cdf4aa3d6c3364535db7b9a474119cd8513f0c2990bb6da09bc5ebf161ad4d44b3a2cfca4f4e000e9df73ee184036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a89131e053dbe05c4c2a693d114e26d8
SHA1e1e92a3a8a3d4b9ee52f289bb4db2356d6371292
SHA2569b20d52242fdf42c6cbee5bed780236a3055009c83c4479c89b35d19952f3b52
SHA51209d914d8c975f52593f18f69b25459f87310f59b0e463303fa976e584322a455a78d83b2a98414f5df70797b59297cdb6756785061b2c15aa89779d7bf7288da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa6a1e12e901c8d10df625a1d15ca3f2
SHA11085b856e38d3f636e69d662e4fbe399f5b80061
SHA256d2fa5464660996c787f0ef00a97ba76367fba85a208081f927cc48c4163fa2cd
SHA5120c00fac08884cb86a255119448381013fe96b7045930275c12bf7c2439b415a7e048722c586c36dc5fc991dbdd18ab6acd22a00240786b35d76046a050d02c41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54afa2caf7a76ec9978e724193dc65f27
SHA176176cbf01a3916a0a848366b6836f2c3b0e06d9
SHA256d8b9671ba8fe04eafd10be51cf088fdd44aa01973385d2a7fdc6863889226e1f
SHA5121fd957e76f8c8dc73ae8bba64dea882f7d2f0f9135f0ea5e730d1a46f1746ca23d95eace4e20906423114825b667058eef455964c7474667a67f44d631008364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c706c7a6cfa9a8f62d569c95d34710fc
SHA163d22db71bc1a769ca86410ee81a3fa7382144f9
SHA256b0e6aeb49d2bacc4edac09251a228ef068befe20cfaab9ea6f3093986a196621
SHA512da920e7bcb6dc106fbf067586576118e31dfa3d9ee1c22fbe81de0fffbbfec114ff8acbafa0b9afeed61219350b7f74d9f8ee71ac243183607fa2f9f011ad7f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6b4feefb25de20519a1d0bb7a6df982
SHA1333487a4fd2e6e84f23e80d3b58cad09d6762f67
SHA256e57a970b1e634a3a1f1efc343b3c950be79f645218c6ab3538768fb6d96de1c4
SHA512afdf40287f7e50e0599742f961bb342c31a744ba7665bba1cd2bc741b9792e45858cf0c1f7905e1baf3be89e4f989ebabc406a57c1f58dfbe67f96acdd794bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e484fd10b896a6297b799d18d84d09a2
SHA1244beddbd296d56708cfa3e3d5f64d0f38f09b92
SHA256cd7461e5cf1d3b7c1d0a9e45fa4bca5c10eb75fc53516dcf64b272e17936d5f2
SHA51297396df59787fb52c82374776be4be6d759c6ae82552e696903d1e59d38b53239b0d226003d4a51d1ffca3bae0ece27b1b8bc28dcb25aa0b75e54c56a82d731e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e381db3ad77670c7b96cee207951691b
SHA1003eb111ecb4c69f6d8f394aad4627627552a5cd
SHA2563b5517c660523a6b14e8e9e5fb1714c2f76babe145d3aa84c130689c6d32d2f6
SHA5120f2b156270d34953284c142f653223c7505e65ceb4d00ad04ca59d3af0daa675cbb75e91f8b6439615220e7a0db5468177632b02b2f5599d68c1fe08a0d47570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc732f4274f8a3d501ef5b42acb1bbf4
SHA1ecda051a1ffde51078e53cf441be16018c080c1b
SHA2566c0f1479b1a198ea23fdb8f0be573fdab3fa08fe21f11fcfdcf409936e22cb7f
SHA512c343514c120bcdb20b9561c3c8c36b8c82265ad1300a1a92a43d7c665a4286b8af3285e35e2e76b148754b6cb5ab1061d8921c1503e5f8b5dc3dea3a9e960480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586e98aaba36b6d5336536150f9567a1c
SHA16c40bd1fafd5767889e2c936b022803622eef338
SHA256324e195314ff0eda8f9ade5bda49a6d6538907221a9d6a271bc9433368a326af
SHA51276433edd7b72a273fc819cb0fc0358bac28f98ea7467873153f4d4bde04480f8e636fc937d2a3a3e1f1d0fc2931e0273f0ee72a3700417146f3c858aae0aab02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d88354744f66342b44f512f42c520bbf
SHA192cf5870b426bca646ee864d0ce4f6f263332741
SHA25624725aad8cb4f128fdbf09756d8fcaab1f85ba9ac8b2dcf5df6eea0942261e72
SHA5126e1361d209dd07c5995da9c84387090ae561a522a281c4fb18bb2646e9f35fa681a51e75bb5d5b99f49431e9904d8cd5e684fcb13ad57da8e51aaf20d41d53fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6544d57c4447c213235268e21f1f98e
SHA159eee0f382ad6574806e7cf300b5393e5461c5aa
SHA2561f49059ed2c5c3fbce156c353809e0961dff6e345f30d30268f85c735f88ad2c
SHA51264d5f4ce531f72cd4a8866a846d4715149a7152b5ab669f91fd162a2b7968153a27d9f43df04fb84674057542072e0c08086e31050f4300ae4b39c61c1f5f3db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528baff7af28c99a6435536ce815d65d5
SHA1ac5d6231e81e129f079278ae6b686c3ffae49f9e
SHA256671928bb09ec1a32a432e2075f88ae3a6613005ae06458eb08f0889f7a38360f
SHA5126c054f5cbe1098682abaafee72fd2f06b2b121094b5ccdc2722063dcc55369b65af6b269b072a73847040f8610b1bb1a0e76e1b4bb2fa45f9cba6413b1a3aa19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b7ec09b512415b7b7eb830901c4573d
SHA1d8d22b10b8a5efdf6c1abe39db7b712352bd6f1a
SHA2568a799d4d1d95e9cae9fffd3c3ad16a118bf90565ba69a95620afb3ceae20e137
SHA512b9dc09deb51e49779276a93d1824702e6566997a141afafab1a05e28b23c141e11645a57ed5a65e2db90cb15ec41c86b2ad6c84f51d9e09fcca384e228839b37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5553f80a7937db89e69aa9835a46b7044
SHA1541d9acdb046e637c4d5c40f2889af85c74377c5
SHA2568faaaf24439065ea74d2ae9033ca93724be5cf8adcbdd6f5b1b12437a4490880
SHA5123b1e219e0380d216490bce91f09fa86613ee1dd1856e9d7d6d78fe61467e65da11e6c169ed9e664a89d5c101071e6982d7d6c0c839c5189f15e89dc34f9d236e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd3a59d5ef4ce7ba15f1a573b63a6cbd
SHA167e3276895d00cb7b32b51bde5b5e7b5f981583f
SHA2567b9c9445fe5eff31ba5a80beb7fe49ed5837390acfa2277d15dc4d7c8157267d
SHA5124d35d19ed7654a290154e195f49bd6df70b60999a710bacf6db4c7c03e7fee4f6969f0f841e66bfda2be1b45247482ce884608bfab44636cd9bf71cfcaf25749
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540bf0f9a3a6195b5f272df3311595c06
SHA1911c1bc5b346d24c88cd8eeb7065b7d138b2b03e
SHA2566719fd4f97cd4a43b440adf0cfd9c04fd898d6e1381e82e8ac9b6b831b33c560
SHA512e03a22816328dbbcdd0926008c61c14090f7a882be8c875c28982c166fdb5f7e90b69bfbf737c9e5f970279d50470add530b53ca4662533892f6bd3ff3e36e44
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a