Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
a499bb0900bbdfb9b2a710cf4dd9bfc7_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a499bb0900bbdfb9b2a710cf4dd9bfc7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a499bb0900bbdfb9b2a710cf4dd9bfc7_JaffaCakes118.html
-
Size
460KB
-
MD5
a499bb0900bbdfb9b2a710cf4dd9bfc7
-
SHA1
0aa6ae78113d47e0d9ede2cf4ac5569424b49fc9
-
SHA256
7601f2c6c073aeb7b05c82a0da276d97c3be6add12a2421c565b6bb69ff53563
-
SHA512
fb328d6380f0f8af2b80567b3928996dbba8238fc1b2e68927d2713f6abb4c0428bc64028b8e4d41b90d3e277ac85134cd3a9d3b4e4a458c917362e7a9f76793
-
SSDEEP
6144:SIsMYod+X3oI+YZsMYod+X3oI+YwsMYod+X3oI+YLsMYod+X3oI+YQ:Z5d+X3P5d+X3k5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c9cf80b9dda3e739a2a219557ecefb61c45dcefa3c172902dff4bcf7f22dd4d6000000000e8000000002000020000000218cf17f0f0253205cb720b847df9b49608143d5667fa6767c754b58a5cbde7d20000000787a71530e465cd1cafc4c8e7fbc275defcd8ae86f13bd77323dedc31d8bd58f4000000084942ebd550ef81d62b9c44ab6f4a536b301c909b199c0be405a31603da75b91a62e6f56d69f30bcb173ec441cad090a65e53f2aa213f25b8b59ef806fc97da8 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000005bd7c8bd7eb5710e33e3e28d0a5a75da2884a714b662b910e763df56b2993714000000000e80000000020000200000000340305f07dd55f825c8ff3b97bcfb4de33ad73ffb5e4db55ef9d9fcd88b30e490000000872bcdb9164edf32636ce8268128ae1150a0d5fb3a2f61219d66366cc524d67a8b4b3f9edd6b4f142dba841cfb6fdc20b854f3f481709dba6b96cc5e4b537ae3a08f2eca3942b9294883d70fbce47f15bf8f3a995e152e21c0ebb7cf48a9276726a5105e7a82777e33a04394d38a61d1b002a48223cdde68b9497f2c0b82449a49272a285282880df4f9080b02fa9add400000003a5a45112a9f82fb97dae21cf03c3549beca7daaed2a28128a9fca3c77c8409707bbd5c62f1b529a7976ffa027a87614451947249ae438026c5991e8f5a17840 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424428729" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e34fb76abdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE855C91-295D-11EF-A0E1-D2ACEE0A983D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1560 iexplore.exe 1560 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1560 wrote to memory of 3036 1560 iexplore.exe 28 PID 1560 wrote to memory of 3036 1560 iexplore.exe 28 PID 1560 wrote to memory of 3036 1560 iexplore.exe 28 PID 1560 wrote to memory of 3036 1560 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a499bb0900bbdfb9b2a710cf4dd9bfc7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5429d1f9b53883773acf2698b58ad0a02
SHA15daa937f53933b22f6186ecbf207095401c18c45
SHA256cd6a45ac7989445c92232b7282e6fd3cd446e8f6cc172e304094bb32c457ee6b
SHA5126228bbc716832fdb0378cd2e5d6711997ef921a149f2577a0444c23bbdaec4738b6d1b5e0c85b334be2e63b736b410fed71e60678d6c07638001b48e07873a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3740909ec5051c907c7228b733ba6ed
SHA150ac0374010892091d537fa7a6833f97dd358c09
SHA256be4bbc64655362d993d79b66de7f8a803f13e36f2b79b30eed3f920c6d0aacc6
SHA51218fef81c18963eb7c5fc65583aa4a9e46111fdb8abf95c1bb47f04aa63e1bb7eb8c03087f94617aed50fd6a234d09463233d6969610c09126adb598fff246ec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585fd14c3ef5ac2e4af765b2c6d96eb2e
SHA1e98b29236262163093767fa7f8ae161a9793b89a
SHA256a08eaa6b189db59c779781c7f4e30cf4f80295a8ba2270ed22289fa0216133f4
SHA5126880e0ddd7863a818c6d117b94a100ce9a45d16b4e4686e7d46e2609aeaf3259c5015b9f0ebfbef5d8ca93bd95940d5e8f7cbb1ea1b63bd6f9f021e5e910989d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6e298c30942968ad309c315f1290bc4
SHA1fd8e739d24ab51472fa19f3332074f1a501a8f57
SHA256708dccfd813bb493d9384e6f86d91bac503c6f937d3eb9cc37a32abeef1241a4
SHA512e57262eca2cb6f3c09be2a5b4f4f72d8c760ac68f66b42937dec34d5823418dffcd69a8243b9dab3193061b044c7cf52114fc4c8b546d1d28859fea4104f650d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517b90b20b8b4c7784a16652255781ede
SHA1eca0ad1a973b3ace51d0cf04bc6c24f5748dfc67
SHA25691d8dfeeb5d108f20954c43880386fb68cb5dd9705556c63e50f0fd357e54265
SHA5127f2a6608488da73f3cee74c0541b077862919694178bf3776983eb550ab2c33c8d765161459253dff7024ee70660ea3e03f2bee674179730c8a645d20176e331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a118afb9738fdf066d393f38a8ac043
SHA1802db7c1c301585f942b23f3a0c83a1dfc259ba2
SHA25656a9e75502651ca783b3300cd40ae7f49b83f30dc48d116f2d7d996407108247
SHA5124f792059c8d5d0117a2f71b932458327910435fb0ccf6b5ae73aeab514cd8a563feb55a75505db394e6ba4208b76a064eda023bba70903568b11ae32082b7fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eec798b83f83efa7e386b0ec0455470
SHA1be3cb877e9185d521f0f189c2261f7e82d67a619
SHA256ffcc06140fd1654b116780c882e93d4bc64ac78ff85126d93d00ceaa17bcff4a
SHA5128c9d472ae26e4d17e25dfa3c3813e30b3c4737a4e8f3c25d8edce12683e0f9712cb42dbc1ab47a4ba73a1cc337b25c3294cd1df208fe222916c59d429b46ab42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52edee92ce94214fdc8c1ddf84c9734a1
SHA1334778453be5c86498b5cf72a0294261b9105917
SHA2566c0aeb504aad263e0aabb323467adf11d675c8aa5dd123820c23ebeb7ba53ca8
SHA512b5a10c673a2df1687e39e4f018b6eee92392e20c78b0cdadf4875885509886fb597f5c56d7ca1e2cce6f949454bfe2a0f82ea7bb4464a9960eceb2e362507187
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4bdc0e05d7ac982f40739f4deabff9c
SHA1f904a93f76ebd3f535294fbc766cdc88e07315f0
SHA2567fb62b0fc6c30f2696320ba61e7e24dd3813a555eb2937ae0c22a0f7f7d5d9b6
SHA5128b48c9633613330b178fd5604ca6e88e0e5b0e572bff0d0598a8c2f3baac80331def2342d09fb1723c37a1c91f3bf76de7ba900ef945f7cb54e79e551582c934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509a5a89b95779beb27dda88f428c7e91
SHA1ecffccb4376180ec6981de5e6cc24a566d8ffa00
SHA256d7027427be7a0d02a722b12f97e63c7f60645b8bd823ae074d0aaa2ca669de5a
SHA512388f8446c840f1142072261b1b82d66a2b8ea23ad1149db6965f2fe6e77364dedc1d88b3dcef032f1aba5c567f0741164150bf194729aafb1e936b1cac4bde74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5966d88fa4d7b4d24e6151ced12280ffc
SHA15e74045bd5ffb2551b73c1bbff1805a3cf794bd4
SHA2567c731567498ddffb7a44f51fe988b9d99718d71a04c838d386f7dbd88d863a37
SHA51256486020d96ae1e462b96ffb8ae39d73b931db72cfdc51d38746ba8fcf1ddc725a1cfda5d126b91514356f34e1c76e3a8ed3a524c3f9e0c7e8e29628b528cf41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e2ba689d9d6cdc3ca12762a6f66938e
SHA1e442b438632893274fb72e24803f630fdcf14d60
SHA256d47c1133a674eaf86d2cdfe674c17914912152bc2fc2b822582e32d92832f47e
SHA512d9bf0646a984b4736feb27fa0332010df8740978f628ffbfd3ca5384d97274527d0b58fb3e069e3d425b26a7a25d9f25f97f6190bc013a9b1f9862f80de93bb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b44ccce4290a93ceb7565b7c2b579a6e
SHA1ad490434e8f862c0323c655c507529d8a7c66b83
SHA256685a48b5b7a60a7a6bbb47afec6a29142be602ee05d87dabf0821fb6c68a4af5
SHA5124da6ee30e39364f2af1211c84ac1f93fb9edd4761a3b3bed9e00ad76b44cb9f4c356a29e5f691c45664cfc3b42aed4e85ae1343c5b4fc207dacc883f370918b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bacc2e81a93ba4f33fab5ecb9911df71
SHA16b26f5b90bbef292ab1c6606cb5b9769be3833e9
SHA256e3a847d9bde760ed8cd403d64e8b76e12c0bb5cb08bc855db55543153fdd5fe1
SHA512124ff2ea82d65fda43270ff32b81c4ce3ef6833b0a635309477b4bbe503b19c1b2ab6bb8c0d822c507b1846dcb346043667fe842474399b46b5ff5890a17dccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58971f73f57a00e6a19ba0a105258e7bc
SHA10eb267569b11ec9de91355d894e6ce177a6a7be0
SHA25610e189b3cf218fa7a6dc49abe8a8e5836f2a2a42514d23eb2199dc9bedd61ff3
SHA51280ed47345f94f42c3cb0032cad74902821286fda53f0a83a2a908aaf8ea15bd92c689f51301c58dd4b1c62f0b5a8b3f21229077762c20b6d33f6692554cb26f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065d5a700612ab5f6de8826ebacb066a
SHA1e174beeff7dd54f562b32067e73956fc7ef4eea4
SHA2566ba9aa243bcccbeea836c765d5ca86e9e18e49358b389d33f7684d04ef0bdab3
SHA51213b82568e99491433ff83454e7b2dfa8153288937ca654fb86881711c82e3f330f71a85a38e4c91fac5fdef43f63754d4d0e2f17a2f7df0f104142674fefccad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5c270b4b7edd0ec2b67c205d74e027b
SHA190fd88a6e174323560070bc22b942b21b4e024ef
SHA2566c200c5290041d3d85a64d4c551457a25654d29b096a3997ff41be398f5ad6dc
SHA51217796585c44763355b0fccd17772f8c173d5f2cf3792f4e69409f1eb1f79cd2ed8aa4f5b257cb612c2ff4dcab483d1af4a8a00e16f4b9e5d9e675e64b5252c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597ab6bd4ca314102e9568ac4e416502e
SHA12d97b52fb0b5317dfa14a1f3bd8d04e63ea951a1
SHA2569d7e88a934888fb17390838f632a5020c9321f00ec423e44fd57980755f8b43e
SHA512980da64d35bc30051dc616879824c914685d6d1ba4b24c1dde0aedd3d06471dd88838e8178df4ac44a2e60fcd5e7889159cf59f12b6d46508675d45dd80c6eca
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b