Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
79c567330d26b8084def3c92753347d5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
79c567330d26b8084def3c92753347d5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
79c567330d26b8084def3c92753347d5_JaffaCakes118.html
-
Size
4KB
-
MD5
79c567330d26b8084def3c92753347d5
-
SHA1
644e38e92e93934db0feef5cfc2a40581ddfe45a
-
SHA256
4d758380be6b6a2171a45dbe5e312c9d4aa96c4e729a38a6600cffcf9092f34d
-
SHA512
f185b40a83e3667b21b86c242380a83a997e6ba7a51493a9eeca9f9283e6f0e83b712d1cef4971ba869a94c21dbcd38cdcc51db98d1133a6b30e3e33302e7dc9
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oWbd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{920E9E31-1C47-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e38a51e1bed66a4686e78c2313ad53ee000000000200000000001066000000010000200000002b9be6eb2ff09aa344897fccbdd92dd746f06ddf1104112d3364345e9213e947000000000e800000000200002000000047e38c23e367236ae278868f93379c6b787f1f37ce39e00082142406c2ce5674200000001808d1edb40584131953e128b44fa7f358dce6a0f78fdcd34b215398423f5e1f400000007e002ccf1a3e7a72d10eaeb60a801edd125c23c9119dc8ddbe1a0b62806a8e8a0b8c66a827901b957f77d2a4d39741f903ba1ceed4da8fb4944782f9c35a11a3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422989787" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1092296754b0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e38a51e1bed66a4686e78c2313ad53ee000000000200000000001066000000010000200000008e2d53da238294f4930af152d99d757cd1663d6f811a29b3d9a2f1267cb388c2000000000e8000000002000020000000bae8b255f26d5fb15e534460560ca5462181ede52d36988026be8caa36bbf52b900000007a0dd4cb426af4344246b4f56115eab89b7d1e5dd09c2b2e65cf8fc1168d1824cbf51031aaa41c6b25852432bb80ad94bc196c1e6ec30202abee0a0b1fa91f705e09813ca7e7459c089baa56c6a80dcc3975d5632ef0e3c0091a950f176bf8d5ce3864832e9a69284abfb36b5f72cebf16ea6f609be4250eb119a906a06f8550f375b8112f6e1466aba5e7dd59aaf32840000000c20faa1a9ed64a2c1c14c194f4943890c0a6e268c2abd4e99d9fe4b055cf7a4f545e33d77be046ecccb9b79642dd79a851b4962656a0626849edc490a73ed1e9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28 PID 1640 wrote to memory of 2304 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79c567330d26b8084def3c92753347d5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a1f4be87a6de3d1a8c59cc1a955504e
SHA1de032915d7e98aa86b99e400f1965c7898618981
SHA256590d805bb59d248098d8e16a22300cb843ac74ac760abd77f787984e7b84dc06
SHA512151f391566e3e07f0d1409a17d4c68e1a6399595e6d2e735670e1c5ac3d14f5e57d37de75920325da32cd321c1f594e241825fafeed4a745141666ab70c515e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8c0bae265e9a7a5abdf995f0598ab4a
SHA1f22f1de4ea6f03c755108d587c7afc62a1ed6478
SHA2569af9b72ddbdafc33f82701629edc92b0ea99f0864fec20879ec96cd1a99ac1be
SHA51212aa50da2a0d944bc3d0780d15b50dfbb90e8332b15a5f70efa5834848cb9888726cfe822c67f16c09efdad7ae443631a7439e210696c6beb3cc46887954836f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557e8592110544277d2fb928e43a77c6d
SHA1b105a9335839cd6fed20606b1f5b777116524fa6
SHA256e95b03b993d971177a861eb14da216ed762b25d075b24b8cecb6c4396adb7d07
SHA5127c092fadd6f42816c822ed026c251f32862186880a77856bdde8f687b7e5dfd88dceb2a1afea8088503e5777b970cf65a7d16b3f9d1edef559176afd6f6d4f67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a46a6ce3c8b1a9eea86aa7d8d42d906c
SHA15f4c1c8f74962b173eebdcb42d58054791850c10
SHA2560fc8528a4a6527f88e47daea0f16b5bd5273a8c2402cc03d42725e4ce2f64b47
SHA512a9c96e2a280c84ced2421f82b0807ba659d68f7c5563ffdb352ece7edbeff77e1f005d5b648adf03817de6051eac3aff60815b78dcf1153eeaa8acd010f7650a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7d6f63b07248fa31b056a6cf4cdb2bd
SHA1af04ec1f8577384d4d41733e09007374e899c02b
SHA2568389a14b676f49e693adc0683c0863cc0cd60370eb26e16e969208ccf734ab35
SHA5127412f4d79a5d37dec2c0050900e51b43c616d6ca479d2226fd26a99fa69c0365059d36cfd15092e88406d2a52dc4c946bba2949d4b568112078965e49be735a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e15136ea4fd268b04f5c9a48c52ab7ba
SHA1f08f72072774c5b7e7c7c666ad82195b79549231
SHA256b0b438122cb0997babd086254ee4a9b7541bb298e89e9af3b498dd6ea5291c5e
SHA512c4a1c7cda8d14b8a121d36cea4bf7fbee53d481850199cfbbef263cf0421264789f174479393ddf3b9007382634159f3c9a0bd53beb73725f045cf99d3599d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbc6a259289c7a2e33234191df511a4f
SHA19a9cd771921a57b9cb0404c22d144954521cf50b
SHA256373ccf1394178581e149c820f5487f274ffa726179b150cc63b43f08e39b8ad3
SHA512eff9c26fd90bfc23d25b1d400612980175d6f992238a71990b9863998eb953ea8a0a19e54e9cf49cc4cc8708e9a1883d0bdfc074a9bd401df0f57afdf6674b7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1c24935c6cb225d1144464f7ee4e332
SHA14a39b09217920b36e03b80737397f16ffa3e1229
SHA25663da57ec7222de962b9f7cf2e2a7c7180b2a1a18fc758ec54098584a6f2aad58
SHA512746b16189ad7c3a3c85c5c08bfe45409fc5709072251a16459e419578c2252307ee7c88d2c3804a1974f823e52c53ccefe84633db19752804aa2473a645511c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f2e98d975d9107a1ef4cca9cb3fada7
SHA1f9517a263b7ed960df02e78522a2124e769d75da
SHA256072367e6398ce982d16650b93888d0d1a38d80881b48faf2799b0813a77fe46e
SHA512262275dbae31b0c5248a1034ff6c554bcba509edaf1ba67682e4beeca2513e60c9ff2c3e9e7ab34b9063bd4662cf663cb814060b2be53ef4afc6d7187476e71d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3a49d7f15b007202fad108bdb868592
SHA196d3bda222ab3b1d39b664828f4e714e0cecd447
SHA2563f36d2d599ff532f3a95da4019d81810291c00cd732c912001ae5fc9542d2312
SHA512f99c00c81f4bab1373f0b536f6c2f0ca79b0c375d976a47890dce2a0f3f1adc6000430901e0f0c85f5e72e8dba4c959ec9673f188cfac180ee58b4ba4a1a7882
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c59fe43a16fa936ab084008bd3c9780
SHA1f933fd0bccdac9022fa58099b00dfa89c3325497
SHA256367c84ec4a023d7fb61d0197a2aa5f4d80ebc12e9864401a71c58a1f1de312c6
SHA5129bc1054a35e0ccf4a570ea7bf70a5da84cd8d36d5c98e9750ba083c0dae4d977021756258653d0f1df0ff1c7046493e6ddbb3243901a2f7ed2a185fcda0e83be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c32ef3b88d0c56055f5109a145bb945
SHA129e5f89c20306e617d29551f370f750497685390
SHA256b19f5c6885b49082234e435c66016442e1eebd04e6be98f904a4ae048a3cd7b7
SHA51289a5bdcc72248767239441ce815f841b1a930ff828ac660495d82c9c5a7f6be291c03963f4dd0f74a89697cdb5cfd8d03442ef261d1ed1f70a83ef34e182d4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d87d9c1c333b82af6fd88bbadd0648f
SHA1cacfda486ef3a0edb8feb52d96e33c02ef85b649
SHA256a0b50f2b198a54dda4989a3d2969829c19db117fbc28b23fa46c389061b87582
SHA5125ee4412ad409cc25ae11b7dfb2cdba9493ec5202055c17afbc05f45afab4536599416bec01ca4c7b311c9157383f44b6ff1fe8ab635da121127bb2c22471f463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a645a181481ba83c4271e9745135ebd
SHA1f57b98a4cb7a9d79492cca5a8f6daac43f4c5c09
SHA2560918f4aa0dee3f54a20afa96af77febfe5f790c222cfb8f9be2545df055fbf48
SHA5127fd6e9ab5681eca12c5db1789442e9ab8edf06107398465aeff7232cde88307c1bf678481ff1b1a0fbbc1237f6c9ce8752907f10bf1632a1dad20bd5fc32202c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d25d269ebfb0ab0ac5a104f5a217f393
SHA1a016162bf3a81aad09581049ad9a660586819d6b
SHA256d2bd972c2196dd1a304963373bc1bf3217141d6eaf3f7f2a21d90f62c2f2448a
SHA512ff280683ebd531a1f0015478248703cadb1793f4f4d441d5b8a0587eb0b2f799693edec3a72e5dacab482c4b03d429198910b1981a065a435c949c2d1aeb2074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1027a301b9fba5907231b8a00c8a2b9
SHA1ecc9672cd88d00059d081fe7c7354fcce5c3443c
SHA256e6daf0a7e04f2f5e54d0c24cdf055c842ed01b4bcda23bf3009e70ae95739a41
SHA512e149643f1ff9633a0ea0cb2aaa467ab61556816452d2faf68866f0ed6e1a6a5f87e083a8ed4de9e9820964de973700490dbe4e3f6cfe2570eacb7f43affa3262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5296677633371514fae891917fa311e7b
SHA1ffd6ae5add3cb781f3e16e37bcd9a5ab1186840a
SHA256e41e606193f200108bb3bb0d0457b11ab1e61e4ff252041518dd62e4abbf746f
SHA512bd8baa058057ba7cbb5c029ee1f90abf441f0958ff0ac9c8dc0da8771ea3d68ec88701ebd57893f836a60e76cee395f8f2d9e819d65d128d0a8d69c3a2e3b18c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a