Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
791bb958cfda2445995d2a2afc2a95be_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
791bb958cfda2445995d2a2afc2a95be_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
791bb958cfda2445995d2a2afc2a95be_JaffaCakes118.html
-
Size
4KB
-
MD5
791bb958cfda2445995d2a2afc2a95be
-
SHA1
b8ef37915a7d6d06843ba3ea4f9f5811360848bf
-
SHA256
c4ac63980d37c5f090d716fdc353a9c78ec7a0a0e39224b4ffd096af45adccb2
-
SHA512
8a440a4a12f5cdc0367d91f6c1f5b455840eca6ad7f2f401006830120e7e9416a9d43a90e3a90c559b6dc724be21e6b573c29d0a9479b4c9a499ef629a935c2f
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oKt12Id:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a1a1f72eb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d9f2521b4770b2832b933564835ccde7f613940d799a5a75a1a8c8654b9f790e000000000e800000000200002000000003289ab912abe7d6a57f3292436176f122f1c8b20d93b5801e902314d26da9b420000000ce0c02d9d4e38b36eb7b9c23b220d691e1dfe87cf0e2d9f267ae8726edc00fb74000000046a6e107012a56efae9b9dd83b84d2d5c9d31252973897bf79705af45450638f228577da815819b00e2d09419f1664d6fc6e996c16c97dd7838f06fe44f6f175 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422973709" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000001938bdb951f842c5d049be11e0fba9400098bd53029461cfaf48fbf17e4c5fa000000000e80000000020000200000004bea6aedc1db27b42da22e94b4afc1c334f44b6397cb028d8f437d9344a522d5900000007bf4123c56c39a689fb4057d14f59c088b9590cf5754c6f7a500f7dbfe34b93519028078c7b454fa4b74a80ce28edebed33a7633c4d698e48ed8af051d2e37457712b0bcc2d456886e9e33f61a31f9823f9cd20dcf1c7945eada86c5ad4d02b7ddaa63af31c992aba7651cbc41ff87e25857f9cf83b73d9c2592122b9fe7d91eb2835e77f5e4c8db35c203bec14863f64000000085bbf2eced70734ac00c50cdd8072ebbd2343f58cfefc7fe14813e5bea52a29bb9ca91253700c70a7ff908aca35644fcd7ee3be37e13cd8771d79919fc1632a1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23035731-1C22-11EF-9BF1-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1616 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1616 iexplore.exe 1616 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2856 1616 iexplore.exe 29 PID 1616 wrote to memory of 2856 1616 iexplore.exe 29 PID 1616 wrote to memory of 2856 1616 iexplore.exe 29 PID 1616 wrote to memory of 2856 1616 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\791bb958cfda2445995d2a2afc2a95be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52453e0efb3de3b69c3b1016066fd8ac3
SHA138871950882e033f18a49db36735aee59522b7df
SHA2563e0013c098a78a5a870ee587864c87dc7654cb1ae31634066a2367a6b2e771da
SHA512dd67686f4aa5e62b9b9e7a11c6d518b6ffb293fb03373de1d27cd9973b927e64d37a2917180cd2a1f7e9475c534fc9c7cb8abf99865536111cc1cabb9db43680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5845fcc1123a64711e367797ba6144ed4
SHA13dcd179df527a856e85d75c7dc4fc0425527ebbc
SHA256e8d6d84bbfbc5135b83736eba27b604850b4ce09c44ee991efa3c95f80605b51
SHA5127e6de51fb9fd9fb9ab6b663f36cdd8895f746335665168de45892e98272820907fd6ec257df3ac7465b2181236c9c4f8df6ac13ce2e62b70465afa78acbe9c7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51836c9a1bf3b4f8caea44a4ef48cd4ff
SHA1791daea26be3727b41058502b4bd19a78ac6782d
SHA25655ee24e55a0ba7af41ce1d7d00a929ca8a5d9ff179d45e978632b46da8dfc22b
SHA512364c0332313ecbdc7294943e78bdc9c615628126b18c67cf53889e5a64c6f14666f2074cb1d8575e728e85302b9e616e51c82e1dd2691c158be2465089fa2113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e831bcb6fa889f44a19fdb28b718b29
SHA11aa8b84496b69fd0dc162697b92ede00cc9879ec
SHA256a4be52d55b0cc12929260d5a4b0a0b576e712c281419dfd4dde3491b9d6c752a
SHA512c179208bc054ba9f54b6c40ddd537e2214069a0082b7dfc84870f8a92737f3c246249b33728929c9b00f1d462460cf7d2076a47779463357e916f4ad08cd3a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af31e8519b79b6b90d27ccb9eb2802d3
SHA1ff73efabad8de35a95aa30b4324efdae7b207312
SHA256bfe6a80765ddb7b72792fc6786588c04eb943db7e774ef9786c97c278c35a025
SHA5125142116713e421741834918fb0a418504ce9e2a5c35ce410bb404f86abc0dbb273b9346e595dbcd04161c69e109a72ca6ffcc7d3e3f218888c1426f11e4cdaed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57880f7724dd7e97a2f9a19ce88282da3
SHA11e90602728eb9e5c116d55e52bdafbb179c77523
SHA25659a860e5670db717132aefb2b72d5b0c4c5503bf76138cec753bb2db30e2bf14
SHA512f7f5869d5333915981e7487b3bb3e3075b1af362d95cf982ff4b6db43c816306b0651f0c4e7065f40efe9ebb62e0bda8d960952872aba870ba11b0600526c1df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c95584fcbf4db28c90b85cc3e6dce31
SHA1505473c4fc28d2fcfa02cafb85407de321b2c7f6
SHA2561ef17f03978e48cff2ec7046d145788351de99ad61731eafe2da9d0199ca49b9
SHA5120134b9cdb3bd60f1a4d0aea08e3e2b8873ef0ad397b943ec0d20ef18a43036a9e60f9478dcf6f6869a6a9606f7ae606cca068d15b341a9ac31570e55c05fed9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567a5c2eb6ef0e0da90fcab99c294c93d
SHA1ae3d279a1b1cdfe27a3a5ccd882ecfcb653eb6bd
SHA256f4b92a11090b9c04f8f217b5c1610a410f9567c8ebf0b3e4c2bd74b349744a2d
SHA512662da89b29d5a47435822a7aaa66af598db8eef376e9d00ecd5e924a1d2693783a5cafa4d841abb993f88bd0bbd1882f5f7f2fce6ebf2a7448af9ce7213e2064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569e9782bd7b7cfa2875548bec3992566
SHA18ebc7b73251d78eb7f6d34a427db0ead9e8ab362
SHA256eea314f23a580e51564acc066ab939b9c504956edbf93afd08e935e608d6b639
SHA5123eca662ba02c2a1c27155f8417f0ed655326b50b15d41f06ef161f226ae56c7153a55df577bd9d010cc891ac9bb92615b4299fc15ccfd35dc75e1a0b53d40a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508f50b96fa6134a773b563ea798be845
SHA17394391fc4af57f2d23e6e14107c9177d3cc7840
SHA25613bf5fd2d161829c66abe1286848f83d76d094e5bc2270e15b4edbea6389c88b
SHA512fc753b3497d56192a5d71e039671298ebad0bda3f1ed3dc74a6e918622e61f2b36129fd6dbea74bc3467f56ccad0af558df80b95f537f2cf591679754cbff1aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aa30c0b764f1c6f3d4c9e0475b2d327
SHA1f4617e89dceba3b2c7d71b4764690a2271fa183b
SHA2567d90e014e4b885462ab52d00ba0b0e97990adb022cb29352696b212cc51549a5
SHA5126bfb5c5db6c8fe90d02957d8b400e510706bbfdec0bbea0ae73c3eee91f95cab48faafbdf9a9ec5d26a8d6062fe4a9e222d67804723860349c2e0b2684aab3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5493a83f8220d3c8373d0ec2cdf8f45
SHA134a1397dd370750587e041f65c5e718914c24746
SHA256816dba7fa278d9fcea868148b83cd46ba4ec93ea2a8e9c45c9122eeb8fda8000
SHA512b7f2d0cbdabf71674c5ee517a8d8f0dd8fda0a3d4a2a06c460f69ea3a1ac49c707cbfef8dbb1cf336f9f274ebde835575470d2e2af536417b40dfec92fe05720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7a0046b6b9ed1c4e8142070b448d249
SHA13ab863f9d19781a301c8628ad5fc572feba99efb
SHA256d603bf5e5702358d46c9f6382f5002afb8dac1288dcd1eecdee0465752121ba9
SHA5129cbf281abee85ea23c9f2f1ef0826c1b99b90965c8077301d4118fb48987fc406406350f784030ea1888999e7615fe97ef7e1f1a4473e0b1db1d7401175b6a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543743d3aab287c64f7d86452dade76e0
SHA1913d17bbb830aa873216c9350c7a60464d8258b4
SHA256747b9a89517c286499771797f227da7acba75097bb14c7e77d87a7a6aaee1ddf
SHA512e940272d81d03fcd556eafa502bad178ce2d94b9d671ca3933ca192b8d3121b82a4895fafefafe61743ed58269d94859cc57c9db7d7706cc93a85aeb53f98904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e541e9747531d1bf647f7ef20fc9762a
SHA117e67550548152e6257649d99676f481b494753a
SHA256cfbdbbc2ae3af92a96a861cf9cf5ed9dea666f313ff4f8d0c5f7931c4303a382
SHA512d0e0726ad81f9168b3b2f7cef36c9a3054a5d99be4bea77e2e577efc3ea5d4716da7a29118827749eaddb68161fa6fe94b93c7faabc892de388b1592f7cbbb3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaac8d7610a7e0d4ceb3f00c818c31d5
SHA16ba64b6f6b0c4581fbf28e35857d34e319d1238e
SHA256b5c598e112ff8153f7ca7161f6be2da1ad99972b696ebd59481ad05f811230cd
SHA512e74f7f7724a16409f2ec6ce75caa36c944004102a4e023badc79325b24aa6bef3abdf41cb7c5f886ded70616af12d03e37dd828002c401ca123fd21ec72bbdfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afa12d9337c22c939d7636bd8e332b7e
SHA100513a32e90813d7081e44bdf9dde6d3c4a75538
SHA2563760aa33c5db326ff850c3a1dc73add876bb9091555b80b1c3697f35634b4bfc
SHA5129341f813770d29569fb103623ff68acfbafb646bc33712bcc7d2e48ee52c8775c548919b6922c7216ea9efaa0c3a7cc0136ccbf181777bf031d99a8d84233128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ed9fa22aaa953a953c5ca4190fc7288
SHA1eee096193a2895451cda6b85371050b004449a8c
SHA2560d425faf5868d7aadf478fee64d5c89924bda441e3b4fdf1dec46a516abbba73
SHA5127cea4c231c9ef8ad7e86cbdccb20d0c7d0eb5a2fd497212964cbe807a2740719f72b42d0c8a21fb0ee31558d48007dd74c4a7ad4149f65ad9fa288d14feaa26e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a