Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 20:47
Static task
static1
Behavioral task
behavioral1
Sample
a24b7a1fa37e73d188d8c603528bdb6d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a24b7a1fa37e73d188d8c603528bdb6d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a24b7a1fa37e73d188d8c603528bdb6d_JaffaCakes118.html
-
Size
4KB
-
MD5
a24b7a1fa37e73d188d8c603528bdb6d
-
SHA1
6f33fbbe9c830291f51b2514d56ecefc3b10d11a
-
SHA256
9ec9582f4f6e4982f7cc8cd244189b0dc0df2f52f778f3b7c9e509b4fbe1c75c
-
SHA512
50a680e07afedf789a8dbc33fc75b334f4c3d434c228e01e8c00cb6380b94854d0f5a0f079f519f5deb8d48d67f7f2b8e71ad22be90a92a91a4cf38c029ba672
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oedj7d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000017288b117a914415a9aac41c11cbebab2ceceace3320aa2b9cb5bf2bcef0fa8000000000e80000000020000200000009ec07444e1ff874d86dad1440a848850e21c2287b488113da3f56e67a8eaf7c0200000005ffcf70ff84689d4c620a07c3c6d335d36c8a49bdac6404a32907a4b41e1f78440000000965eaf4355c131750e86098f3c84817f109b5369c69a360a532f6091cd48e9f2f277ecbe662a20fd390379e35419217b60a86ba0958dc4718de8dc88e2327556 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a483e009bdda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000bf1b42b93e1f07909077620d6a2213c6e92f10ba5d80f47fdffa70ecdafe7804000000000e8000000002000020000000664fd3d7d4ff7aac3747d215e8a48a6ae3b4bbda9eff7645221e91e44741c8579000000027691c21f8eed5e39fefe8b8663712a36d56d6d08269f1db1766ff68ea7396f7d01b756dd383471cc6e6d13e5f7c17f46d9132ff0cb2c027ae85b7cd086be0ff53dea35f4b521433b18f7958e2ff5338207ea0cef7e5931ba3c01fbcfc1ca7f1a4f7c958f367ae843c25312ee1ac9d17c650a4254100ad040dd1d192c966845f8fbc45699bed521f2eec48382dfd11a7400000001e04b6c582dbe018addaa7b1a81c56e8a58cb43b40053c41fe4069c0bf708867a06339b8c3d4d76256cedb8bc6d19b24cb882e18fe7ed18d12ec7caf7ffae738 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BF19F61-28FD-11EF-B477-E6415F422194} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424387144" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a24b7a1fa37e73d188d8c603528bdb6d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5839eedbe5131f2a3c096ee5ca6d28633
SHA197fdc7236a59c32fdeb466a67f37956177af9c98
SHA2562ab7d5cff4fbdfb308b36d414869ebc0afc7edc93bbd852df2295b03312b94da
SHA5121341f232749be5154835562e70444ef6d2303a5cba0121f37b8fcc848161951ea623ddc2c59780a9c094357bfc858fc25ee9bc7d92d824ab3803a307f1672756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc7a798a382c179739607929919b6825
SHA14f294a9508f05f5089cf979f1eada328f6d4531d
SHA256f4c8d88abba2a70456855f11a1c3fe99360c3281ae3baa17ee943728af28e990
SHA512d80f55e9661d53e310e22bea27ea1b641dd2a5ec90f5d9b018c6e72792e8940143f62e8baa0643ba90639389dd84a74a00cfe809bb0d5307143fa3f6c8ad8241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538039024fd663f76d5d15ec73ad85f86
SHA1177a8b1952c31a70857ebd9220ef5c3ec830213f
SHA2560baeeb03a7adbe58bd531bdd9f407d6b25cbf0b4286931e8a283b515bf7ec6a6
SHA5125611dff208d3a0c8bbaed3ff402730cd220b8173a08d4ac5d5037933966d1d5ec205c5972d897075a54b74921b552765237edbc936f034d84242268a49b40a29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54459e188340ceae3b6d5b6b8b3c6db73
SHA1baca390ecc1420d6798d44055431fc0122f4d345
SHA256766af3d028123fcf37a2ff11ae8931bc6ff9b0e4a21d8c7766f7dc7b0d320ca4
SHA512b21210ffbe821ad54a5154274dfd66e3ac603e14ecdaeef0df9a5d651affcfb7783bc89d3650014d2eef18d6f52c0e16e2ca990e18ae5ba19af4c56f4fb69939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5100e2619115943da669e728fc63b815a
SHA1ec17aeb86ce2e7ffe35f7329e4634c7415c71e9d
SHA256bdadb6e42398b941547b659e85a3d24b221fa8e9f06817c219fed821ebff32cc
SHA512b007317d35b2cae3b3d451008627804eb5e41f95476bc5f85b4503243881a793de76104acbaff1b7bc7354bbf3609035b9f7fb90ba0b4c016bebae1c34be3b4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fd8859b706cd9625077e1cf990ac363
SHA18a63dfeda92837bb912d4b71e723e94235e70943
SHA2560508e133a5ec5508170abb88e0d910a45f5a30a777b08675daffb9fcca43cc6d
SHA5125310642615d19c201241b7133b668c1a268c479f42138dcf27b6ecd689516e6ece6c68b76e12a152c6ca4ddfc003cda708e9101d9d531b027ee820b3100a72fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506afe70367efd72bf252478d5cfb9918
SHA11a13a438877f194aabf9210835e1a6fe2ffb66a6
SHA2566fb56b55fef545849ff9af1d33eba26b6b2d515161bdc1e5f50495533b42017a
SHA51248aeead46865606f452c8be9d3d47261d456d8c9da99a2f03994d973e6939e5b38a86aa0cb5f532bf629cf685b809476a003e73b08c8332ee793151e78c8eff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559ea4f3817a7a8ac492aa545c6ce7967
SHA11490ac3a587cddcf4825bba9f6e8bb5e1a4822e0
SHA25678fe71a2d83c8427773f6b4d506e5f6a54ea6f0f1cc9f655a0254b26e15794cd
SHA5129acaeb3f87f02d758459230a3db2e8ad0df4a6ab266dc112bba0657b6f67957660c95399af12aed266a078d2b51798387feb48c25c64b523f428e4efe2257c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5ce1f021f848ec4e5ece404d9b7e7ed
SHA148df4848ed94aa58aa7dc825c724c59157ece888
SHA2566f085a8b4744cc1f287d041154a6127a39065e585e4fb43e0abd640d2bfe2b31
SHA512e93cd8b7bf0ee0bd3217d376ceaa631a5d5b3a716e9bf62194cd64e68539aef2d027a88666fbd1c5059d2d8ada9eb77421904e96c8cdf3f342583c3b0ca61d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534891bbb6d01a5d78efab7b0cd84c23c
SHA1bfaebd3e3ed1b6e07fad8dfeef9f0621556c6868
SHA2565152b1cc022fbd735362baf7d27f13710a7c813917b00b8b0d7328830777d5d7
SHA512bebbc2c2b2a8fa1d89a845370588a14c3a6ae5f5b9093c744885c47770581c460b2862288ca003c77165e39d650d7bf41fd05888a3e88591cc9023aabfccd734
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54057762246905deb6949af2e1fce14
SHA1ac18c6af8d40c9a2b121a310054bce8ad9b21767
SHA256a6dda2ef273850734864408bac43d367c8d983384febe48ee35d8a2eb3eb46a3
SHA5129905b5499164ef266f13887dca01f1d86833c2eaa123b56400c30f1ab679f3e8574febc06f18cf2f0a0e0546c5f225e5f4b28edfe6b1d37e7e0d1f9a33a83d6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fae4ac3f6a90f9fcb165f429cc0357ae
SHA1112651ff0ffc93bb854ca7c8d1e19d369f206b36
SHA2561a1602199f40877f42cf1ce54f5ddf4f8bbba35aeb357b305d22c21c39d40b37
SHA51269cf422dc9fa769bc3dc95915b449a94d4fe44681443c9344512865a1bdd9008c4e778517ba71fc78d318512268a73a1422b9afd4d7ac0a42c03bbeaa3e0fe8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bc9f93be0b76e801e64d33223dd50b4
SHA1a17b871ff3ecea5d7392d717a0b0bec803de0ddf
SHA256e125575ed31346874c53837b1de01003dd61365f1c64bebf94d9a85877fa85dc
SHA512b3e0b5d42fa761f0a8316b5b306519d986ec3434ef04a0928b74ef9b673d77b924e3cc51790208ca398664d20a1a6c6a9c07ab5cd51bb7247144c779ea96b8c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c00813dd1858cbdcd8c91a46b701d43
SHA14a790249756a483f0fe0c7f7f6263a5ea3c36290
SHA256be6ee89a6559cdc9526b357c29000eaf8499729e890c26deb640444fcccf45e3
SHA512d32a7d801710ffb68c98385ae612e4ebd50cb43ebd6f4fbb9b6cdba3686e9a5c754754358cf917a119bd4794acb1741233e1ed2dd4e0f826c4b7c846035be555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d39048e6adeaaadb6bec1eb5d4df97f9
SHA151682b26abb1b637236757c4f5342f19ba9b05e1
SHA256e1aef56e84344abc6a44d3668ad96238206f27290904aafe1a020314396bd101
SHA51210f120863133ea7b6950c09ff839516e92cb212e7c98947a8fa8ac652de62243b85b6239ff6d5fa8beda07f0790261066f67d585af04162e237f42d653f6c1db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dee62b8cd87bd5c2c72511a36609cb88
SHA15454b3c331d35ccac8a12fd6f15c519e9bb65475
SHA256ccabddb544423c157ff6184e7de587cfb1166a664ad8b6ac459afae363ee23ad
SHA512b5bc76c229ae25f21b53134549f01dd9f612f19f27c9d8cb3d5ffee3b2af129eb22f823579d259e3f770e9c6d18e97ed65bc2c85712b5dcb540d3bee0c8240df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eecb1b51736d43bdf457726b435acc8d
SHA101b8120b17ad33a03c6f4b3586894d9799c3ed1d
SHA256905fe7732e197cbe2ae51b32c710370ad852a87d931131944f5cf395185549ca
SHA5126d4bf783ba4fd52c66f3b9bf0885ac86fd4a9de575ba3875456924d14505ff6a7f9832e43b230fb4ef83f240285784f85768221953ed321a1c2880920112f654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8e2a27014ec57946d488a1f1079326a
SHA1ae063f416e88f8fa2f06515ceec1eb2f671d96db
SHA2561ea7e40b8016619f4d991e264b06c6b1074ef7b5d358ea881ab6f543846fb0ea
SHA512a018448d0e55ee8f955b90ac8e6c68b9398adb8872cc278d8c3e0cf8f52d7cfeb1167ac15c4a9a78634d6edd07b69f98d69866ddfe2f1b4d74e976680a0e7cd6
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b