Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
a01175d851f62939612298ed2d8a0ddc_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a01175d851f62939612298ed2d8a0ddc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a01175d851f62939612298ed2d8a0ddc_JaffaCakes118.html
-
Size
245B
-
MD5
a01175d851f62939612298ed2d8a0ddc
-
SHA1
35d4e1d3b9ca862af3b923cec6cc07886dee49e0
-
SHA256
70e74bb0fed8fe49717973df8f687335615f1b946502fea45144a2cd1d85c027
-
SHA512
ac9603ef5f1874d4c8d5539f1a1fdd2487188b26513a9ffa17f34377b36754e5d5b345144b16e291709f635e196c9c4ede8dcbd68e3c75a279ba0bf9f5fe249f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1E3A471-2897-11EF-9B2D-424EC277AA72} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424343587" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b675800c98125b72ef6c29ad62592d351a78a65003a9acc9ce630ef866d0bf05000000000e8000000002000020000000687a108a76f72a3a62d65df7affdd91467b96012f470d19f4fd2d4f03e8bd259200000008973327d989efd4fcbc3381719c2000eba7164423c572a05af5c4ba6ea1729d340000000d59ca9b7bdd11ba54a22a429933d0cd19c209b60bf6747cbf52509583080e60d01bab4862f98147961c2bdb69cf4c4b8341cfc2d3a878bd2946f9f9695509844 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0020b376a4bcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000ba8c4beeea6f930e299765c5a418c93118782063d979db374786d709caf1e45b000000000e8000000002000020000000f3af6a81463f472b087888e090e08ff6b9ff605fd1b4761f2b59de3d17a991d090000000a97471da7bbcbc4fd200452cf28655a1b85a398b5625cb7350c4f9f3f7b8a18c74b1144fb76ad2f54dbf8ef9b2c6750e99e21d30f1b6a17f799aff84d89c87cc8aa617a76f6b2333eda21666ea1fffaa24fb7cea638b04b181a754f238a648762f036c8acda4ed5f9e33cfea99763bcaa8cf39515b785279e96bc6df46da128b135f907f91188779fc406fcaecd4665840000000d4699b659511cb82045bd34c4b21c23fa1b7edc378f9e14c1daf521596723ca44639fbf689c151f1044580d46afc099edefe3bcbad50b22ac90d7f060d798ca3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 1440 IEXPLORE.EXE 1440 IEXPLORE.EXE 1440 IEXPLORE.EXE 1440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1440 2540 iexplore.exe 28 PID 2540 wrote to memory of 1440 2540 iexplore.exe 28 PID 2540 wrote to memory of 1440 2540 iexplore.exe 28 PID 2540 wrote to memory of 1440 2540 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a01175d851f62939612298ed2d8a0ddc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570372ae0a39fcfcb30b66be6cd741336
SHA14036169a4ec3279a28ad5132b13daab7089dd2da
SHA25608deb14fd07545b868a684fc9730c184778a8174db7ebc5297b151af5773d8ac
SHA5121ba43b195bbce7f134787ccbecc17f7b4196c5d5d4c05c9c12a376ec2dee26c81ea81ff81f63d83d09134493ecb46e53187e6c3cf6468f58758205604b57b754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5361bc0098a73a18d9eb661dec90f2740
SHA16a5565dafb175b230486e5918536c8e792492007
SHA25672a6e1da5b79fe37d0159aa6466d325c49e515d050c63f84f969c040b3012e21
SHA512b2226c943d182cd4675e7518aca7e7aec3218f66d3b870b22f0607e84bea5342c10af02f8e87f61f7afc14f32f600b28e62f8a64bed87730d8d2ee7048e3ae4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5928443afd3ec4744efa67acd44d37ed1
SHA17551aef9993458eee78f354ca70ce721ef7ba2f9
SHA25608e70e75fa95f8bd381dc451e1379f0715322633771f938b0d19d69b4c7c6a18
SHA51240da6a8162b9ce8a7f4231e6f109c6679e9c41c631389ddea6e702e849df7d54f77239c589309b75f2c4a6b97ee3f185ce6621d737928709ffa4330b13366cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1cacfaa6925bbee27fda3d298e783d6
SHA1d20faad5a554913cf3a37ed4fea022486713add9
SHA2564e8a3bc797307d776eaab0ec8eab45a452b09a24726d91a76201fa769d040649
SHA512f1566787f9466cbf3580bb3294eae308b75984a1abd46b657e644b86ab3db58bd8318f28701cf48531cce586990d6f248607e4831354e66c68f7a0d0d5e88c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569762fb62aff9a413f70842080e194c4
SHA1f6399729d8cde699561839e2e9b0c88c16d8c246
SHA25688b60d12c7705d10b4f22a557c3d517403c571063523743aca38af9771d03e9a
SHA512433d6c89131f19a8e8de0bd1890ce1c362ea6b42b69a4d9dd72771c8381ee512acd8c19448a3f83f6082b2e5c42de1d92df9d3d114cbf4a490174e1467d9f8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5970c32545447bed9d41d87eeb7c7e3de
SHA1295f83ad87affb34d2381942d5988fe85b1e38b8
SHA2568294f20eaffa3144c48318237af5e0f648179b4984d2afe4223de318ee0ea5ef
SHA512ab7950c3ca92ecdceda320be864d361717d145d380dbc817c8e736a81d6bbdf07f82b929792e35ca1efddf3ae35317aa3b88320e0a8490b500b538434bc3ee96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eec8d1fc4b1a51fef23322ada89637c3
SHA102cd116515a161b5517945a605dbdfeec68e5aee
SHA256dd81d60c08757608b9c442166593e214a7475326143e029914badd0b363a606e
SHA51278ac5c8f9e2f176ffe3c6133a6ac1deaf4159bccd2390e0e6614e6e69aa28906f426b1aed76473e157b33656bca233ce58b952e6420ead17592f66c9fb106e49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547579d0171e73ca5901ed6479144c9d2
SHA16be8d04a777ca4fc233adfd73d5799b0aa949006
SHA256fff4cb009dc31fc0c106755f05b482040970c409f88c2c8b0259b219b0afbd2f
SHA51273a344268570d626a1f4b9b759f8524719db369d8463b9ee0fac524cc95f917c7449ca352ace0d7ef04267d99426543f192c79bda8a9c3c9c4c378360cc471d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e72a1e8a8cccc8dae85959d8f11352cb
SHA1485d5b2182ece44a3d416fc66466c6c8e7c369a2
SHA2568d31fd43bc67443ac364aa6c8bad028e10e48e4881d4d82dab0e3462aa3a0046
SHA512bccb6912789001785dbcd2d585432deceba23ebcd503049f6bf74f6de11e6c1af76a2e9ead1235df1aec3d1d482750cedd5d48a236879e65f85d8641426c93fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590d8ab0bce3d3f3af1ffa389c007c5ee
SHA11fa9d7b36bf3677f090d42309014c4fb12be96c3
SHA256e556a7e8738db88b842a511586141ace19ea1ffe02a4c46ab1fa1d0ae5e0bb3e
SHA51224a7e668eb4cfb248831124881e5e71da313c8b9a631084ae0b218713743eca5c87e3b4b8628cf4c6e65f1b2f40a59ed310223a47558dbdf204c3401ea534a03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053cf46664343b13e438861b27a2dff8
SHA149ba2e7d8af4acfb5789c20dd2d4c2dbdda934fc
SHA256cbbcff7975e3ea9b507d70d3d7c4e092eace81e111ad65efc391b61b9d14b448
SHA51201f0b3c11ce227eef19b619ea40a2b425ca27f44942227d8aad0fc8055384f7783cbb6e54abcdda70a396f43ed659dd1e6f225f71edc94c2ceb8025c551ce775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595557c1d5a754c8a55e7c9084df0e48b
SHA17981624edaee32d2205db109eb29b3bd282236be
SHA2566419d75ea6845f82cc30b3bf0209f87e609bd5deecd2eb89bd1ffdd205b03bc5
SHA512a1058f1b2a2d750343b9b1c7760f47e2d77ce99083647400d27434dbc6fba82fa6493e5af9739a5cf177bef665ce8df681549cfe55cdf43598c7da6fb30a07b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b87336766e2aae1e74b9bca332f9f3
SHA18fa6aa95b83f0d0f3154d2c5d486a931a59e53eb
SHA25629ecada93034bbaaf9908d9517b58176f973dc1be294cde3d9e7638dcd4769fc
SHA51288889e07e02147a320c1160664fed0c78ecb67f673caac3633886f313e201a978fdb0cd24e9ef0647ec1494e4ba64e380308b1fd384e681f108871a27a2483e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efa351081d9cc44dc47f167176c80306
SHA12313be3b06b5f1cf369e0bda237a4f82c03335a8
SHA2560a5c5fec77e59adb5df12319060b9e5defd370b9795795f1f32ae31a13375bd1
SHA5120d42ac42e8aab04581f83c9deae1224a43706d663cbfb92a1e07e5edafd40c942407dbc1a00ed8452b2da63569f11f79fa7755d9ce7eca44d4fdee5fd32b9ea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5151d599851afe9a089514aa38ab1eb
SHA1a204b02901e07098593018ce317c54a0f68743ff
SHA2564687f4a02946dc0c996a712e4ff73698a5afc6fbc93b73194f44efb709ad7232
SHA51220eb02b252855b6e41933318d7492c96ff297eeffa93c03103e130ea2931aea9f09a7411b4fa12e1dd248ee8e9373432303b21e63a4826fd28514e8e82b47891
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504a35194a7ed9a1dbcb4ff9161799b27
SHA188e3c448d6290a08f4aa7a7fe08da0ee9d242046
SHA2567569373e3756c304b0595d2f34296972b1140edf00486a464c573007c87e3ba6
SHA512124f04e057788f5dd95f011dedb041138239090a2a41e0cbd0f73004df200bd7001f0f5a42242e0a8e47894def9fab700d221d284dbf7a69e07a3958c920506e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5727d4f8d6a3397320fd4c58ce596a74c
SHA1df1f1171bc49d4663cba884d8d8c3af67ee47fdc
SHA2560bafba0ad7b17d1aa6db89e79746dbfef8655d82d6d3e9699fefb7f0df885fea
SHA512f4332a4835cbbe90371bd2d1ded8fe35558a7b3296e9d982ef0679588aac18607268c96dd55bf11d5eafb1eac20d335daea18ff9e8f65d128de38f84bd0fb9c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579425e89b725f66acc7667283a21e655
SHA1206ffbafa68d15e35e51f93375d710cac5938c09
SHA2562041a09166fdeea4ee212ef98f5678f1c8a833909f66f061ac33e32d1899ee2a
SHA51297106d513298deb62d8fcb7b382b75a35d60d346d7e0564b6711074c39e9ca45b9db2737ca86030d02fdb44bc16d313af3f927f0a11246427234396f893cd88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcce865a042b1004672c0c3e1c64eac8
SHA16eaf526ad3e809632c8eb416d685665566f30a54
SHA25608c01b4cadc4a1761da086d6e87d79eed27f3769890d886a1fd9a6643032dda7
SHA512f3de0c760dcca6fbea8814268199c6df1d22bf88474214d7baa2c8df01b9e33680f2c5a4bea5549cf3a73b6483ecf0194ce229339f8773679a594b40c0de8588
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b