Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
a135c6e69e4d4d3fa963f66cec6ec86b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a135c6e69e4d4d3fa963f66cec6ec86b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a135c6e69e4d4d3fa963f66cec6ec86b_JaffaCakes118.html
-
Size
114KB
-
MD5
a135c6e69e4d4d3fa963f66cec6ec86b
-
SHA1
ed50bf3334c4b0ee719d5091416a091ad8dc437e
-
SHA256
39d0f05dcfb915e7ef77796612665f60c6e73eac4389b3c39080dc245741ebc3
-
SHA512
6f7a98025ac853ef55d6392ca44c2e2808d9d0c132b7af3addca4defdc9d5190cab32bc4404c5eafe9b430b0343915201ba5cc89cb18640e461d0189081a7e14
-
SSDEEP
1536:6vBLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGC0:6pyfkMY+BES09JXAnyrZalI+YW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0faa4e3dfbcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424369106" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d387200e4e4b8b7e21620080ec46062ad7be5e4be6b6606d7703610671484de7000000000e8000000002000020000000393a5a5cafe0f47dd7e66103d5352dfddcb3b4ab93c323f5ea6906e9b2c3c9e8200000003f29c8043ce00d6bc1c0fe13f986b0fcd4dddc6fe4f0b2969a6872cc08fd52ce40000000e8d0a07520e6f30bd39578935ab9da43d4d85be19c94c0a9e4e420e2b86853f96c5178600db75ab427e91fbed18ee910a979788a444c6c1f1f09ce40252f1226 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C572171-28D3-11EF-BE23-DE271FC37611} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000004b7e8a98050b96b8bd1735e2b1f925d28da4d53e066011aec54ff8d000d51d18000000000e80000000020000200000000788f9da71f95853e4b71e60f737dd48f09968e89d55598dbd6c8ba99701c46190000000568e27862f340fbc85eb59ffdcc76f41f860209dfa8590cd58116977c358db3d97eaf850ba3038b25b3ea920585696cf712eb9b0d3bf4b2a5dcdedd700904f0a40ae72e8d4a2a19e3fbc6f0bf3d32fdd8a956d6eb84ff7440195b3f7721a09e038dfd1f7e817842c787271a7f60c54493cbd76b198cf5caad4b84e7d2209de1687036c0d5d3c12cc92b7ab9c4d81eb2640000000cf4bcde2993abd108c72a0199d1ed22b9ee75dd59b3616f2b190c4e7876a9ebc57d38fcfd99f08afee0390c5dfe4c8dd19f976066d56e47db11de85d5711436d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2536 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2536 iexplore.exe 2536 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2272 2536 iexplore.exe 28 PID 2536 wrote to memory of 2272 2536 iexplore.exe 28 PID 2536 wrote to memory of 2272 2536 iexplore.exe 28 PID 2536 wrote to memory of 2272 2536 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a135c6e69e4d4d3fa963f66cec6ec86b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176e8dff5cfee24c5f57d0c6d3051134
SHA12616c4e62c1ab72b1ecf2bdc5ff247466967f383
SHA256b5afaf663aed6068019c3d8e4496acf35b8d12e334fe173bd5d30cc087647353
SHA512be96d2e4a1b7eae1d6a525cd364c5a134ffa978f5266cda91c20937c5be2a58b783443d579bfaf748825ce10ebaabee0747a2162cdfce4b7d487cdaecf4110aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5060de12d9e8484be673948bcace288fb
SHA1269375769c6727dde61dc54f6a8ad66588b63ec7
SHA256001bd40bd89fd35a693af2e0989429e8322ea0c8d29417d882567162dd483bdf
SHA512225002b644c5aa9b6ef1348cba36f55b7a1689e5e537ed793608a2084f50b0bbe17f9be441f3b4a45d386a49d6e498205fa7f06d001ac4344c9b7c52d7e980be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5537dbf1469d2dad4fb22fa7a7fb0c8ca
SHA1f49a5bee97ee288bf3fd6d53423488a1df57b387
SHA2566f67a109b640074379455ec9bb924ec475b5c70557db0bf9e4b300358747e990
SHA512c731758e3658b3b58b9622bd32c54204b32bba1c2578fd1d419ed89430c18245e3c6e036d7bb2e7ad0cdbb798f1c22919536ca9677ed7cb145b684da74333ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53545bb4cfc32f3372cc42d74eae4c9ab
SHA1bcf5545c15921364de7b801baf31139368c992f8
SHA256eff1da90c6e36e8ade1fb213b065127c43c0cfb57f81719f4489bec46c5c28d1
SHA512d1c8ca3ba1f00571d426a2fa092b32ac3413cbd8f53de5289b21deb93f41f8e8801f57baf05760395fbbf48a2bc574081ae5947279b5f46ea4fb87fb8c843855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525490d4396cac8590836f816364bebab
SHA116b38fd94ff28d88a52fac6dde0eec0c04bb3f51
SHA25672d8ce7cb68971f58fb6b0a0b7c70dc3b77ac7c75a2b7b531ce025221ecaa8f1
SHA5126c30085cf6de1c25f5ad08ca30d563a31ff896f933806c7d4fe500d97c3b15ae7d76bb675d24106d4cc7e234d760527c1de0ce57cd27b0b4dd695b1afdd77ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c5a83dd9157e46553b5d9acf6b9200a
SHA15c36e22e448f29d3a8f0f029aa91a95934af56fa
SHA2563209e02cd177a4126786127c75b19ffe77e64d42ede06fedd123e8fb39d17073
SHA512e917a9236aa7aa21111d37b543ba00c671d5dca5b1c172a7a1ca8ba64103abca7612a23c2f40d355d0b05c1a9ff1438bbb0f77a0595f714d4e8d890dfe091ec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd27afabbf3dc70cd14b7f35feec935c
SHA13056b29d2c8b2eb668f58305140ba8dda0260b95
SHA2566314a8c7e87aa34e592b589faa4976e0af1e4be147fc13e07fed903c26cf4954
SHA5122cccb047be1b46a44db398ac5ea5947bea640ecc4314e61ca7ae6b1dcad3341a31cd7211eae42bec501f83cceefbee73bf732f8307d71eefe3eba25a8c7fbce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529ab71cdabb856630382fe377d327910
SHA1f0b15146d432a81adb8dc2a211a2c6410ca0e7cb
SHA2568d4a5fb32a4b0c120978db27f26a27c37dfee36409be130cb7f4ef6f5e247e0c
SHA51279a4aaba1727f36d01bb354629d851f973d5f534e63cc5b799f44742f116e3ab1c630c4d884d9d5472fc6928f439ed5021cb27847c4c4a6b3f7928ac9fb664a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50942cc20608a1183d19c808801c977a4
SHA1872121a9c620bb0419d8fae415cb346ec0f719da
SHA256e4b67a3e542955a0091f06b354e80f870769b156f7b0c46206ed2b72b842a7d0
SHA5120e746b4983a6d36066bb1dee20ff39eb5a16da739b46d2b7f0e7411a6b5e84b59feabd7679a8a8f3fffdcd9fa64c1849b1fb0490e4d0a2e4258d79e101c3a83c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51487001b6ebff1fb305248ba33ee32e3
SHA130a1834d395c602c1cbd6c98237509517a0d7dc1
SHA25626851787ea8d5e6effa7e8eb1a149373355f0d0f18c37f8680e911ce7a61af72
SHA5126c2646d444e16f98db0d6611d4fae6b84945fb004982f3b44151a096c076ba28661c0d2bb29900c1de80fdd705ea5d27a64df3601dda1127c99f9a3591aeb84f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb037a4475c493f1bb78eb61842eb510
SHA1496ca0c16918c77d18efe5092784d1fef2254df5
SHA2568502edab3cc479cb42dac02d832a05d00a178f7be9202edf5ea72d311d8e0ff0
SHA51265c91d58f8d30fa016e9f7f3aede07e8353d05e000d227a51900f6f8452c9aea2f666941db6b4c9e19c96836d993f51b9708a7eada7964129437777890dcbeef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baf818d54dc86964102f63aa3094f6ac
SHA1227c9361c5c8f2bfab895dee078ea4f12895f551
SHA256f0e5bbec1c05d2a764a384038855591741f7a1a18729d2c5ee98f1a58ab8f661
SHA51254e39825c65b87e1e44d72d088da0557a9489544742c4d0af6eac229f23ccaaa5bbf285532d68923ed4b434dfd686127cca49bd5fe9f44291dd4885de9e49f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c212962ce3d19fa8e824a5a21f905b83
SHA16fbb475d57a1f88a5cf136c0acc26b318475584b
SHA2566e8be1050e13e2b09596a91d5cbf287aa533d7beca434a8e1a124cc302dae0d3
SHA512f10536c294e213a6e15888cf9102dae650633ef40b75ee648d37a89fb2411619141a5dbd765e0aa36b2daddf4c84d662cbadddb3b212cf8d06f61f2d95bae30c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b383278212877986fed29638987b1767
SHA1846495b613f6590a213a069af7a27fd154397906
SHA2564b808660a78d0e3750e563a15b13661c8e9a16355ef91698d5a0cbf046f29cec
SHA512f9f9363ccbb84969afff74a0eb0dd8a764b93e635404b48da43fbff56e42575fa685dce0d088a2a7750fbda91579daed8e6b9bdfccbb06d967686a0c56a07f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536702539b27ff8c510d6d1f9ab2a38d1
SHA120462c12dad1b29a0b22aeb853efe320484d404b
SHA256651c2fcf985a0b1d1e8f21b50300dd117bd93c9d7858cca138ad7f45e04e9100
SHA512731fc28a6f31321d03f83d584f71392c47859cb4d368f4d9a08440b4fc6f4ac3106faa06f05507c2750abcb36727a64edfc7eaea4c7b0b12979ce06996082ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e42b6a405d063f5732ec44ffa5cadbdc
SHA1809fb1daccd7a731adbc1b020d72c54ba7cc2778
SHA2569dfab89288323843f51b8f5eeb0ee1d0048897ff8e0d80af8b3d25fffd76bec7
SHA51290111386d30e6a9591f71b61fc34b4e047004f5af6607e6e705961caa4898662e5fd084dd20dca0479f7169cb29adf30ba3af70e49e86d658b2a42629a8bced9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bad1457fb55f7dd2dec97a5067d6646
SHA1bed3b0885084ba05f750c6a974e89f401a6dd09d
SHA2562bae3b7819b9267d6bdb201cdb640a400e354d4e1c78611c5b3936295707f743
SHA512d0c094d7d993148b47bf4db9c56197d8798b7d098da0d8317b3c5a60e4ba5c7e0465216317acc2503cade0e42949150d632f5e51d94b9daf637dac9be2301326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a51a1f0097bc505c59cbf22d9976331c
SHA1b232257b704170370f41972652d187cdd8b3edcb
SHA256986306e09a225128bbfb77ae976cdb6a1da5f87b79e92b100ae822358a5c0661
SHA512bf0388872acb5f3ee7ed22fc29e1e4752ba12a0bf24184d73bb750a0bc1881bf0f7a743db2ad3e551f01a05662407aeec1f14d625c87f251063236b156c45fa4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b