Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
9c02a507594536d04ce27801a4defffc_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9c02a507594536d04ce27801a4defffc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9c02a507594536d04ce27801a4defffc_JaffaCakes118.html
-
Size
20KB
-
MD5
9c02a507594536d04ce27801a4defffc
-
SHA1
7aa15d0a6a58e4f18390b051d3b9ce2654c775a9
-
SHA256
f66195798893d0b963f4fdd30c9fbc5a11d279250036923287e43b203f47a79f
-
SHA512
fe13aa47514902b8a38c451be1c932d4912a7bbe7f7d11bfeb96ae2e511f712dc02ec02580cff079b7256ea3ab062a57a7f9a325c8d3195c798584641670151d
-
SSDEEP
384:wbdOtZQ7PS7Qmg2HZ+CdeHiNp7geVhAeAfTM1xoKDlq6pwsbLc:s7uOe1Osc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5051b6507ebbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b7695800000000020000000000106600000001000020000000fb3b0c178e8542959bd7cbeefd175cffacfdf09cd1db2eaa4923cbd8acd4495b000000000e8000000002000020000000fd3114592b45d588f12fe252a91d232aff8df6bc7fbaceaf42b4e1bacb6850509000000041a42a4e712b87875ddb87d6c0d0a9734513079258935f4345b2430f2a30c87958eee05efe3a572c50ec58c5b967d78a19d82b6e2c44c8e08d42fb7116ede4de78a58f5c0e010530bbfae84c09a34d14ad061708d07066e6aacbcf8e5f6e35d08f5d07291734a95301e59bb99f79a16ec5a2432d8b7877675b3f6971036145a623bc68d3f5fbda39ff36d48a0532408b40000000f66ebc3d8062a08ded3717469f791ac9caf35d4c4477e0d74636fd89bb41ca94429210727ee4348d574b4e7dc03fcdbde7faa6e87069c6f9a0978e0ffb14469e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424217251" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b21f55df55657b4197ec36ecc6b76958000000000200000000001066000000010000200000006dd952b3443254f760b8ac015564806c17f85bc3f4c804b1817db467267b212c000000000e8000000002000020000000b65828cb0bb70cabf9c4d36afd1ff120e7ab05fca974c43bc96561f5bba29ecd20000000cf9d34d456bb629824de1da9aaaa393bebd90dd51f85a876001264057aea00b340000000c1b177c1f16b63cf72ae5613eb1fa4450a87dbc31c5eff6b643fdfa963e288b288504473a5661ded25b1551b5ef2538d83d14e0fd9c5d1715c262cdef7c0a6fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BC5D0A1-2771-11EF-8554-DE288D05BF47} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2744 1724 iexplore.exe 28 PID 1724 wrote to memory of 2744 1724 iexplore.exe 28 PID 1724 wrote to memory of 2744 1724 iexplore.exe 28 PID 1724 wrote to memory of 2744 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c02a507594536d04ce27801a4defffc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a5e842c9439a03dea91a225baf2a408
SHA1301b4c7cf0dd1c398365c7f4c393f40f81646ea0
SHA256ac68f677ab3af4c5a08e9a6df3b40c4f5c9828de74111228b11f1b6bbcf00aae
SHA51225e51b48a6cecf025eda9e683cb638f89254604313c047149f19b51ddac47fee211b44ecd57c15e644926533e2c256b7ea1c202a7409ee34a33e1ca9ac2255fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594e9a3bf28f53b119254ec1f283acf24
SHA1539e25b73821b5aedf19ccb14a0bf0582d72e95a
SHA25644ef634e9f6685248daa1f97a4d20a3513b3ff96efdd0f76e5d26d9e159e1341
SHA5129966d2dcc00a90bad697b04c9aa568888037c1e88985c2d1a3f4f31bfaddd68a23edebeecb3bce0860e6b1acf0037db62c86a5b62afc3629c2eca731fc06f3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548567ed6eba053d442f3717fde1dd0c0
SHA1b80adae1008527dbf3593cc6ddc3e24914575097
SHA2560c35e5d57a3806b20beb763e655972d232a7ec57324a49ac217cb014c22c8924
SHA5122e689a27b8c483deabaa91dee8cf03e1ff386c632d4acb49b9b05acbd54eeb98b689b7ca9c29254f73f1af0b824fb3623fefe845d404071f660f995a1642c83d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfce5e74a03ec86d693e72a1c570039d
SHA1edea956c9c14979bc219637a6602a6704a2f7957
SHA25651ed56e15ccbec6c327dd5a9547031063a6808d1158e37611eed322bf02cef09
SHA5129a0911002188504d17646d92683e1a0782bb54b55d461f4eef4018fdb33dc2ce23bce5103bf1b70701b82e9511dd6341270ce5b26530939fa38cd7d59a6d4ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5def5303885b2ff10d1bb8e9e24215850
SHA158ac5cde62836a62a587fa09d2799286d584fdfd
SHA256ea811c7e49e9fbd454248155ebb7ed6e2db31694e5502125af00e2dd7dca31de
SHA512aa0484e3e274d167879daa2cf9b6194381338f75c2c4edd1fdfbf57d135ec2869a002dd875941942c4ce797994d1dd687bd9fbbfa5913452a00939fa8bf8354a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dbd45a9e6dd55d39cae4e9b52866f8e
SHA1db295e4a035ed0130e2ebc8ab51508635f5eff40
SHA256a6f96f838ff58869acde6e53af1188ce7cc987920ea938ae1afceda8c533cc54
SHA512d3dc963900a3af800b0dd3278a95e8cb2fe83b46ffc55334042de87c0e6998c51c275178c0705c24e3614eb21955c084bfef3ec90b1a7a068651bdc43ae7aa8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dad3632d6503018f2ed7048571531e3
SHA1c48fdcb9821538790ed1b55d71cc35b7fe85c5de
SHA256597cf4c98eaf90f3cbc1c6805817728860c02f2e35a9a6935ac24bfe58958330
SHA51230a905504b0a5d644152ebf8d87f6abebe77379bf444de92cd9b8be01f9ab0b074e04ced664e3a8d152d22608462732d50c1c15c9dd65e10dfc61fac53dcef47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582f2c5bc774b01b2525c1612397dd070
SHA1c746336c19d70ed2f142823d4f91823681af8c84
SHA256327ff3afe734982343e37450fbb27b5f82c296017b1ecbcd4c84cc9c2713011c
SHA5127c24abbb7fa41e1662750b41a12f71a6b3c834cd5eea64c3a46a411ca3dd03d419442483415e624ca67f89e5fe506feb7a947394f365eb98f952168372499c4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54393c5e70ffb6e4dd4dbdb7c3db3b67a
SHA1576e38680a330fec80516db8334c1552cf399a3a
SHA256600cc7031a6d3b02d62785fed8eb9a0b6d24924372a6d8a443bf95c2fbacc7ec
SHA51218c59fe34eb664f8ffe45b6d98c0e56e0d1806d1330aafa2b61cc043fcf1a45b4f77524874b45ff46f26469b3dd854479799c4a360d25cd90f0adbae145eb024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4242cb3b042b2b6b3ac5bce13d580a1
SHA1531d912623f583db0f142e8f35b5d2878bbe2bf2
SHA256b69b0fb9abc60f381f6cc8fe3540d27bcdefbd822b5494aea7bef4dedc22f931
SHA51264e44e2f285988fa82049b26f7478feb1ea09593bd73423b6193549256da4d2c8ac0fc2d2e4d474095cfbc46ea37f570705593b626ff7befef9e6b4685c9a55b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570fa9b38e9d87a01581059d9d26320f5
SHA164c8ea5d579641b2beeaedd5b59b51bfa09406cf
SHA256547bd682317ccd5b9a7bf005c184f3ea170c92c6dc098726c6153e888d32db2e
SHA5125a5b094f158db8948cbf2efa47be0fdd881a22e8ef363faee2c01e3046f5a5c74d330c88709dd3708c87354151baefcca9792d94b5bf1745fb7ff2d88006887b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f9c080fcf028a104115fa117fe84135
SHA14d190808f6f8a953d19aee05d063baa301601e20
SHA256ff2247c2293eb58dfb99102f373b2f976777d8dd1dfaf0b608cef96f85cf3f3a
SHA512ea444f768ce00905ac32f0a22783a6fe86b4e3a02e15ed60c24c3434fadc27720e6c1c6a922b0116398d93c6769096c5bb2c8f5eb1d54003535fb15dd667a355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ca95a76bef55660a95b24b263210e0a
SHA10103917a05045de50e50a104118d8e5a87e3e5ee
SHA256ab5eb239ffd1af2ddcc9bc3e0d90ac5ec57fb844b9dd06bb99b5a887d6871bec
SHA51277baf6226f02b06cc5dfb7f3fb77cf2aa1c7c1034937c9873f063edfb9b0e019bfa63e142a47927c1217901b040eb5395d16f934ae3ce2c003e49e5c075e58ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568b181144db25ac1e32824f991e8350d
SHA12c0d56a57716fafcaa74cca8e1045fa1767706b0
SHA2569b8fcbccf23defb556ecceca6b143586cbe635914bbf327ee50ee9ea44ea835e
SHA512e297a0f5bea1c5a409dad7d683538af913af0818da8c419f92e17ef598b9431e404b22038a754799e430200e0ce64f6ae6a893059f6993680197e8454e935bed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe3e351807f51a2159a339e7b98410da
SHA18a95a277eb2fb216f84e32691cdaaf53754f6f6b
SHA2568510bb84005258fe18b7fc3680d80a831dd2033776340b2545ed2928b2fa072e
SHA5122754c7101e367a957f1753541600a423e51aaa4aae55867044b6ccb2d62e1681470f5ddca9e0fab2e0c57f7fbf486dfeb769089f491bd80a7e2f15084e7d9bee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54efa92ec6dc44cd6390b8cc7dc8df692
SHA139903f93a62678bd6c92a67e65f67d68a1f1b131
SHA256df360c4a1d026e8e16e314556c3aa2ad9f49cf27619a8916e987498b8b8c2b0d
SHA51237cef19ef6d99f1989d6c04166ca38c30b191f3860894fd82176d566b454ceec22b430b1ebcebce23c668094ecbd91bc995414f3b1fb3fa59224f404f52176c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5634fbfe4036c19d2c518220ca33c42d9
SHA15dea3145a6169a85aa66b517db92cfdf4d5d33e3
SHA256d9793a670546275b85504b897c68a356ccd824e99d74d1cae66421f24fa5b314
SHA51271db91892f6a8454df0839ef007affda44335d410807006ae974943c4fd7c0721183ee44d7934c09461e68431cbda0cf85ae9eb1148d2a5f1252c8eb2d39b2b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599a3389bb2ce2691dee952549e16c41b
SHA11bbaf8c4d514fd65d1f864b85df55158191f87a2
SHA2564c675ec749426ea5f9b6339ef2218685f8771fe9bc42d05a0b05529a77f1d86c
SHA512f353e336be64ce12a949b1099009046b64c82bcaadc8a789a78344e5fd257bcb76cf6e747e240f4a5d4a3b9fa0b0e99ad8c84ea43ab212d52668a1310b4f8931
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b