Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
815fc3053851f2b9503a37da81db6e83_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
815fc3053851f2b9503a37da81db6e83_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
815fc3053851f2b9503a37da81db6e83_JaffaCakes118.html
-
Size
2KB
-
MD5
815fc3053851f2b9503a37da81db6e83
-
SHA1
04d1f72c74ed6aa12a8b8a9d659ce8cde9ec94cf
-
SHA256
ba8806f570ee2f8f4c7faefff474572e8c7fce854ba298e3776ecedc71638c9e
-
SHA512
209dac8ae2a2002442da6e27161489f0d60de46905507c61dc0e230d54e2479a4227c11b6eec697da1c394c228f4733a081ba993f8e46588fe0de73f8bfb6f6c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423167054" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D9637B1-1DE4-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbc71463ffc62a4ca188ea493ad4b0f400000000020000000000106600000001000020000000ec8bf494b4795c6ff3fda5da2e1c434dd26a83270d40a825eedd303e448f7b94000000000e80000000020000200000002de0de086bfb4728fe704f72de641575c3b6d5a9aa225b88c63dc24f08419e1420000000a86b8bc5d9f3005c15fbf703867013daefc68fd49d6bfcf77d5ee9399c73d4f9400000007c67017fcd166f54337b28fe7954ce72f60eb6471d6651057701720f666159ef218f353f9c71605849c5c7c32b267aa8fde7f85030f2d460d4a2469fe62e84f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a092d022f1b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbc71463ffc62a4ca188ea493ad4b0f400000000020000000000106600000001000020000000b9f8990b35f66c22447dc301497450e7b9fed7701195edc7f2c5a2420da2b973000000000e80000000020000200000007f56b4a4c90bca9db8c17b838c88c136bac14b6c42132aa67bbfd4b713d3eaa9900000001977675e16ecb71703ecbf42fbcd1fd3a66bbb747fb650b1b18835d4cbb683fa0290e494d8d28e396397ba9611f1aadbe3651c9e4ead978e3cb0c43379d38b83364e83c1bbfe4a0cbeb1c19214867cb29b4d91e5e03851b47619e700f6c4be3148c6e247e49b84b9c7607ed55050787841988bd5d10e46f5f1b83ca7df93a24cf275d342938a59493b538b1a42d1a5fd40000000edfa38e99366d840595c73df653b2053863ab2015c0c02681db01ac4c1f3a50b433768dd13f7f2d4a674a0c36658ba09c5bad376cf49dc0bcb026653fca727fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\815fc3053851f2b9503a37da81db6e83_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d996b1fa0eb517587b86559a5a3df826
SHA1f50202d066ec71ec27f039d4624666ed6f849eb6
SHA256b2ccccb436c50f40606427bef55d4e086672bc309326729f121f994f44b9cf7f
SHA5129fe1f10db09b2a4f1979474d31493b94f204d769a95b4108229cb404bd2c8a0c23a11db0a683a25ac469a8fff51007a526fbc4a331d6f27324be643277568a36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a60dabb7ad7d2cc78d994c27542a72bd
SHA1c4142684eb509e0a9c285d4ddfbfa4f6224e5315
SHA2569916ae1320a355abaad18306cc877df2d9b4b5b4e7ac2efe52886d13337d2582
SHA51242fec4437b75dc1f4c2f807f11d299b3b6fc3eb9ae127c94f8eef106a3593dd2800f772766206d334d43c581061e7a28ef40a5afffbe27a45cdcf2c03cc85779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e82e2b1c7f32745cadaa4a1c051f377
SHA1b8555da433e928b25fc26cfeb04a4cca2521b1be
SHA256a92a01d4f0cc83b57a5e3bfba9b3c07cfbbd40bbe948d8a0efef5f89e9c380c8
SHA512fb15a932099813378db4def54ff18ecad9912ba65307a3e59bd3b3d2a07363bb0e6f72ec96ac540f61797871add828f574b24300d095616d9ddb13b7689937aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561dea1632d14863663796ca5dfc23c3c
SHA151b747b1c1c156f37333ccaa55f56ca15f5ad225
SHA256efc0ad8c7dc4794c287cbbc9238253505594b02f33e05d7954470ebdbf73c172
SHA512b266a9249350d7956794a4038b6b7a6774cea14bb496bf015cf6d1b1339f73a75170512d2fe29b277e367922bc7ef40eed43d23cd0b0e403533a4441196f9835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580b5687b82fae443ccae33ea40e0bee1
SHA1250d63e85c56faeb45329bc8388331128495c718
SHA2564c4b35d644a5e0d7c358277fd2ee5ce5b4e7fcbc0ebd6fce866889ae92a982c2
SHA512a42cfae4661fcfbf5180094e09e0fe711e28b95996d306a1962db843e7373d93f8b676e9e3cc399333c9a4a84e9559393ddb7c418844d923f7c7de75be74dd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592688a0d81aba0f660f2ec47a2f12bcf
SHA1d1120da02a15086c14f28e86823136949f6c06ec
SHA256ab8d0352967cdfae8e4e01e47b3e9d4521f57a71fa137059416924b2dc4fdc96
SHA5129dfca94451846951f50517b22ba8e8e59e0e51fa0f794ac06a1efbc221f56c9beaa72bce4346c83944625b8fc618cc5887352dba19fcfc1950df891bef3aa796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518eb60822daa92b45b481d815144f691
SHA1b1179ce7643925fde4c0a5f1636f63669a98b044
SHA25675dcf7d3bf2569e04500300491134e231921ed740229adb30535ab680ed65ff5
SHA51222462dbd791f2bcb911691fce3dc8f7c0f54c1c11779ef123232b136fff33f9b4a2a35059607ffbb21a75d584d104912585d8e6ab41395383c385e8e1014f4d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bee59a25423e0d95c1758e2fdbecb509
SHA1897eb9afffdfc9373b3565a491f425d0fc939306
SHA2563897a261ce5b0befd5df489e7c64079ee25cbe7e2738865a4a371202061f261e
SHA5129aae5aa3c8509b1df3b11a709bc9de83d4f010ac7d5e069417f410d14427da2a59c59553cc898c7101c55567f36022f96ea9c6e528168d7a5245c9c0a35c996c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0a2f13195a96fad05d53a0d5086f652
SHA1c1683512371c70487e20afd32993746fca7640b7
SHA256aec400cff788e1e8e3e4a53cfa89fd39a2ba13f33daa06507a8cd89f921ac7b6
SHA5122b28424fc7239d51845aac6a254d66735b13008fd90b1014df7735a17a4f57313b6da946230dd8abbe2164920e855721876b5f184ae75febb1ee00880815b310
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5085e17cbe8fafb4f61b33189913d79ab
SHA1d996762b6c5299cfde9d58ff4f48655658ccb059
SHA2567b0937b86f0546c9a58baf4d5c0564adc7b9cb74fc3577c32f3d744c1b4e79ec
SHA5126c5589445c72eefaac9274e6f562d829943c320b2b382649a370b64df702fc731962fbd9acbe79115ce7601b66867a603b55b7f440ec7762588f3b64aecb4bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a3d5a321f45a9ef9727ec99925cd702
SHA13745705166982cdb21f323af18295ee5fed54443
SHA256b74ff010ed1c46076bf7c034a5134dba9f1564baf466f426b8cba635b9065856
SHA512cfd6d8fbd331a8a2adaaa023deea488f8dab2e2c02191f74ce70523248913f7b221fbd64921f22407d3c8bd117393d40d9b5daa62a5d2f8567916b98b4e6472f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573104345755ac04be61c33d82fd0dd46
SHA166113ae056cfec5548853d65c9037d36e8ac1208
SHA256256a99d586e67323d0b278da227faf48f80e3b527b1b51b198d28e7df6046a1a
SHA512b6b2c42c0004fcdd1bb2340b5d912dc0f6dc81fcc1b9702cf2b7ef74a74d3259e3cd095b41a0b998e312987bf5b92e99d2dd7fef6d5d48a040bc0e59f8435b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f51e10ffa2d8d8493156b7023eef9bd8
SHA103dcf367e81c990cffb9003908fc0debdf80f924
SHA2563a7c2f836f189d49550bfbd19d9a68ff4ea20b09d379d6e7284cc1a356856e28
SHA512ee15092da7778e28068ab77ac8735a220b2e295258a0df366aea068a726c071844f7afb01fe31d6a8d35d1e34cbadfce015cccd80040c2d4f3e94a2d49db1dd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e301747565e568f502f7b86aab4083c2
SHA1e109e90c03e2d79125e33ebf6d231c928b8b8536
SHA256714941aa853cb6d988a2b33b215205dff52959b545ece5cd7c52f1e485580acc
SHA512dffac51cbeb16769d5df25caf8e0830469b998958e41ef5f9be41816fe8646fa5257e172ba06a381114e664a8321477d0d8e8649a1aaefcd81d50102fffa84d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5255045db07aa8f25cba576bb7bd5bcf7
SHA10b15b19201196c516e293adfcaddce1047bf07bc
SHA2562938129a7fa1644e071f1c80c040626c843ab9744aa5c46df09d2954e354a6b1
SHA512db33ec9042a0004963190a5c808ad22eb5f5d671058012c84816ee5f3264c42a13ed075be78aa845b9ee1fd53b62e58665422668968d7c3ce429f7d3ee757da4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572f16fe73d2cb2651af5c25daf6a2a6e
SHA13460c5fd9eda4354f513aa0dd9c12fbac07e47bf
SHA2560b2a33169fefc322599383a9b60c91e8c5be1b0171e7fcf69d0615a51094f39b
SHA5122aa8fbdcde1e7b102841b8ca8cc9f0c0d1fb65685c4e738a3581601d02d12abcd33638008a8c37c6711a8c20b93a4d88122cd6b3fe304d946229e665f39cd3e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db83c4f3ca2507f9ec96f4c425579b8
SHA113abd1177ab08832608b8a10991a9cdf05aacc81
SHA256cedc663280a54eb5653d5b718257c6624fd95575db33bc29a65f8f9b580a9c97
SHA5122f9f484fb816162abe29c55a9e082dcd2c636fcf57d4d9b2340f79fef27c02572e22512032fd7b789925b62f75edcac8348ac81e795db5091cd14272a0b790ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5454233b9d652412d53751b9036d25112
SHA1cacead13760f71a1d850f738b4e4c28083f1e60a
SHA2566d7e1a520276dbf1cfb909553441e8ec57735dbee03ec6a8a71b115ec780a5c7
SHA5128d5753b5f4b4235e268c3552e8136f27b6ea3f24b891580c4e41a6631a3c88d3b6037c994162868903a91c8bc5a7ef3c99a8665a82f7962eb5f5616a75cf361c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532407fc1db8716c003d6fec5d9aa1381
SHA1c9cb18c578ea18c578d722769a537858fbadc29f
SHA256f8ef9b0d5695b9479a3b7c47d8e6484066d47af62762c28a4cfa6371d2a7d8e3
SHA5128c699179853dc317691f7da5c544d52ea715d39624236e8a2483a62e5471fad2d3f39fbd9d7fe821c4fcdfc7e03b0cd8473b58409fefcc83ce8565026f1261f8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b