Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
78dfcaffc860053df1a75f772651b6ac_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
78dfcaffc860053df1a75f772651b6ac_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
78dfcaffc860053df1a75f772651b6ac_JaffaCakes118.html
-
Size
1KB
-
MD5
78dfcaffc860053df1a75f772651b6ac
-
SHA1
5b06f37c8dd1b19ac0cf882a30c46eb056549178
-
SHA256
2472aa233b3082254e9aa81151c45cca2d79d880b83278e721e6aef05b1f8bee
-
SHA512
c699633f4751cfef39c7c553ae3ac104ce27eb0817b11a09d342e97427af0bac3095e648856e840abb0faf765f6fd5782b461f0667350a49171899365c46371f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10adb10f22b0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B26F311-1C15-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000011ef78a67fe844e638adfbc2a13d864c73ca23a3c00f34c6a053b4a2cbf00297000000000e800000000200002000000025bc5cf4971684ecbda1724135b557d58a060ade9c40137e0caa4fda27ed4ac220000000d3a2f8759bb44f078bfaeb1f3875fd8b94561c8dfa6484d0e507ab91dc9d53ad400000002db4167ac980841eb70e722161be3c17ef4a34e8c8a46eb9c2a374fae2bbfc31b0655caeca4b725fa742c894c6107fa37e62db7dccfdf74e5dc81e18e4486cce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422968165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004d1843ccf68249e2d4b7ca3d702c87341b1cd9e770684783f4bb0dd5d593e508000000000e800000000200002000000012fbc8f64b11008a6b3b6331df3621ae0c05946ffef96e67d0c7cedb4d9133cd90000000b65f14d3f0351a18321036b9f685339c880faf19a4849fc478b7845310e13670e2ba81a3b40d79451f54fc2e6ef41185ff629031a0a8ea05d7034e39bb72549a9ab9f09be566a0002f3188333daaa8e81452116edfe5cde918b38b6a82241303effce2cbccaf2da00567319a891e1809fd78d30c15e71f3e3ca999a03a57cee441e309697567e819bac8ba0eb7a4c7de400000008de254d76d4bdb68726885634dea3f9fa69014a057a2ce92863a25e5a7fc8cf3332785af09934913fc44af3e3e237da7439750209076db15960d061167995427 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78dfcaffc860053df1a75f772651b6ac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c8324817a5a20038c5b9a3e215fa823
SHA13bef5be25ee822d7e991aa0607405b6ab6b1d38a
SHA256800c07049c5a5a99fa42c3430ec72e904265ebd9e753d5e7e5a53365e4fafe7d
SHA512a565388794d09c03e757310306b7fe5336cc67e13bec7effec62c1658d2e621ef220fe6604c34dbac7efc86b12d5c9fe8c8b45fe493609df2e0c696b490014b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541bcbd276ccdea4a7f36c82a87484b28
SHA10c19f1c351ff59d39ef9f076ceb107b8a66c0fdc
SHA256f56bd3f9231dcff4bb8c81e66942d221610df92ae7a12d936b9cc9b6746536b6
SHA512e809e211ce06f09d02b82bdb4c9cca9a75ae3355448127a81e18d546035c35be426cb8fc020de4456989b3c3cb15cc27facdd0e3b3bb2b4de39206224362e8b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d4e2c37c048a90122d8d0420462e45b
SHA118a84a2c5ca01e0f09f85dce3c7f8a9995f417db
SHA256f74a83532046cafb5599986537d0eae3ca721ba2c5a88e9c2db312e17e16cfcb
SHA51285bc3ab0d5863b8fe8d2117a935348c6d0c25fd6d3a93caad29505b6dbace84e810a674e4fdf6ea7b3e4cc19fd9e4f26e5be5e12dc7f530ad8849c1aef5b4f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dcbc4f837b41c108da4a602c22cb57b
SHA1d98a1367a1f5d5b74ebbb5939d4d658e62dd95fe
SHA256af9b6962c7f73d0863e07f1dd76ff5809893bd4ada9ab4f9c69e48c0e9709a22
SHA51252a4ef6e0fbc5572777696ce252d36cd53305f360464e21aacf578b510a5b39de6355b8602e7b2abe09ada9da6a6b043b5ebc0fcbd7e95021ec19f2cc226e464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5732ad9e1d01691304661c28e2ec971ed
SHA13333c8236f100939ea6acf0b2c8a757f37b1b0b5
SHA2560be23d303a0e0f9b8411b6067d1d0dc7db7684148a70f26d6ad5171ff3dd50b5
SHA51202f82540f8c511d49536838ef09f57216dfc3ec520d5215df5bccdd270b1131ca8efa5a400dc22bc4940309340fb06bef06467dab6f49a96236dff6a8a4c229f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570b941ed5aab2702d2525284daccaa6c
SHA1097b7cd08f3ac1e95fd6d5dc0f8c1a21fe706b25
SHA2569e62d2f9de921fe6b5285e1fe58aafa7a013308ae83377f143a7510ea241b364
SHA512cec3ed262b53fafaaf8663c80f07837cc2e5f1b61a3568c14ecf15e34d2a785772653800c0ddaa4ba85d1c4d1b504f2e98c605b8771765a4a4f6c5f10afeff81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b226fc8d85d19933d45121a70994b8ff
SHA1ecdf9692e7944d689291c87d3c30c01623fabfeb
SHA256a1757917555d9f34ab3d0e7608411713ed6c4bf47fa555a3a01abd26c50687a9
SHA512df3f263087547accfd9e24eae24a373edf52fd777b6134e2d7f64c35a5ee4af9d186f4e671580aad1c7647b9c7cbe851525f48a6c3f1c4e5075d3560529b5e12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bfd79ffae11d711f081114867b15140
SHA19f5a8f067be2ba4a143f4f5742052a7e08e479f3
SHA25669f40f47eca3098826a20173ebde322ab0cff7b7aa462584cc66e7530e28e221
SHA51280329fb6922e60aa2e323483087fbaa1bcd742ba7b175f5fee4e276353f3730de69e97ee2b5a777907dd002e9b0613f0da4298061e392015ebd30e37ccb071c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589582100a0ea92eb6733e671bc2f566a
SHA12d515a99a1c2c66ee912460e3d60c1ec096a48ea
SHA25664f7ce349f86afa525ddeb4f8a6302096448bc27257b681a0ba504d8eaff5176
SHA512ccbdfc32d170c9e131ac25369a9fdd1a6923f217abe2f150b3b86ed58007a98a02cc8154fdb9bf58ec5cef5a6f4c4f00c21c8772ad0aa53d0a483b9cbbacb8f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfb0ac1b4acbc7eafa6c575444c3b3a1
SHA1e36f866118a170329a20b8484ee506fc45ed50e4
SHA256286d14b6dd82a1b4df698c320875f49fd074f6ca29cb14d058990019aeb58a54
SHA5125507656b4b063af4b48d89376caf8f2e97bfc991cd2d54d603d3943fcbfd0457ad40b8c8eccaafe4e36fd0541f554c24f391f5ddd61303a7558c05231662d62e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d41de355140b74a71aa89837e2650c36
SHA1724b9860fa0fdae59a2d59790e56690d2495e732
SHA2560c4d33f13fb5294e01096ff02aadcaeb58dd9c963a70b6cc8cd359f252c2557e
SHA512738b494e282e1cf18c6a37fa737b2166ed477ab71dac2bd0a827c0361d26de230e6777f03925f32e7f9d366d2a7ddc3b3b9766186e406cc05494c2ad7b79d1ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597165211a02cfc53dd4c45547693c79b
SHA1db6db9a56d04e684c9ce7e2532847e0f05ef6de1
SHA256c2a9c535d3aed3c86793bb07077707a22aa3ede913c9a372e78cd7911c0b46db
SHA5124bf63a213a73388b0dc8182dd2861e15315ecad7e3a67fc41f07be3bb624572273fc7e71b6024ecb058026200f620532532a64118d6d3d32a2187ba3897bd554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586140cb0d0cc4ada70ad5676041ea65c
SHA1572e4452bca8804497c768f1697d5e4139a7517d
SHA25641d4cb238aac90338800e63b852bb9b3a4341314170e5fc0e5713be995989223
SHA51227c5566075b48916d34c0a715e3bab872a7351217b6389fc9b37c15e20ebf4d0dc286fd780405046a054343c7c0c0b32198696f837f20ee75850f6a4f8cb95ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552af0c9e8545fa14a8b93b012893bc96
SHA1792fd684c8f6d0086ae9c000152d2411c8ccfd0a
SHA2565d57975e64b952824099bebc98e63b1465265080ef62014c2a0d64aea6bc7540
SHA5127cf28507f4af543cdc18c6509234a5e55f5b7b3cb149b4da64103ee6330b9e754ce0989c0fd1bce1b81bbdf8a974ea487e93cac2ceb72d7f343eddaff2f48857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f28f023cb686d8de2dfd96b106881f8
SHA1f61bdd8c401876835875173678e82701614955df
SHA256512c32131b26eab16b8d75581cd2977e39fb0b101f803e72bf071182780c75ad
SHA5124895c62c4631bba1138fa28ee62c28e6dea18e76243ead44770d23f4793a99046bcb4e3f0b3dfbd9845db2c040cd51f2a53ae639cca53679721c360d4d37e4a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50240318c0eac8e446c2101b8a2cdcb0f
SHA1fc97412266564166a4c0b35fee163f14bd6f4374
SHA256ea216048326b2ec4fec2a967d4fdb1637d03649b4dc3e8c0dbf6090971818b66
SHA5125fd49c1511b7a384cd590b9425a0d5da473747aef5d4f10b2bbf7fae0c3972e6a522f0955e342068252866a0b0f08dfc6af4c0853a5e5ae6de471e51f814dff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5870fe32214435a8355b656797c3fde2b
SHA1778a58743d170067b8dbeb15e66e5c248562973f
SHA25693ea5fae98f7f3b40e1158ea90aacc5aa93eed533878dda4eac1e7e1ee223bfe
SHA512ef3fbfb350946f5e00c77a2467c8f45ec4ba680d0e79da606e19d6283efb8ffe9d910dea416c1637bd8d2b4f78d1e887eb70652e1c68eb3755a61a2d63317d7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541ec984e4cc5c8350848f96faf679d37
SHA1c6f2f25225e84472555a40a2f20ffe973a49dd52
SHA25698099f7b4363df182e183f019d33fe30455ff9005ad76f5134710f485bc31a4c
SHA512705749fcbcf2e632555ef79ef77021a84bc4ba291d8417f0e7f015d60cf2db5df81fdf78635bc0008496b520b5112da0b108e08d95afdc9a2c7a8dba0be27d96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3214e1d626beef139102a19041f219
SHA158ad234e03f87345bfeeb1986955996647558517
SHA256192613cd14a7184256bd427c0ee9b4602916afa6f700b144dfd6a340d060685a
SHA512e56ef52cfd5b56516715775f7c5fc5e6958415b4b7fce3dde97eb748f06b3e0dc1d7548ce6c522117901b23acca4106e0862905e43e0bb618b3c1291cf0222ed
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a