Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
ac16f8b789a2ace75e59165cff566b98_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac16f8b789a2ace75e59165cff566b98_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ac16f8b789a2ace75e59165cff566b98_JaffaCakes118.html
-
Size
2KB
-
MD5
ac16f8b789a2ace75e59165cff566b98
-
SHA1
62081374e0f13fdfaf934e2c06c3d811686bc009
-
SHA256
16e99273b02927a95a2fe8b39b3479c5644d07a0ee83c5d135471aee332fc21a
-
SHA512
9ab6a6b95df36e065dc2066abdec413319659e256c60a2cb818274f98746a6afbbcb0196fa31a8256277a72514813a56fd5c2cea372b6b2a70bd85a00dc0c14f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000b2c56b382abc69cadb1b111d36a7a06f89626190f067b4e05445b42218738f7c000000000e800000000200002000000079f53d0aa6bb7242a6b51be1c5ca602337e5feb52c6736619c3a25923007d2df20000000558d53f1b5a34b96956e51add158d307dd0875c7101623980d58b12a4bb9c63840000000b0e07e16dfb1b1d1ca98b30738dfd99b6666e3817c4de23143b2da0b191e9526acf95f5bfedc0b5f063daa7de14014e5adc806f3204e5abaa67515ec6e847429 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424570930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000628fb8560d0dcbac4ad5711c3e58dc3b37a7701f4d93fcc64843bc3f2bddea2a000000000e8000000002000020000000f176d151e7284388a5fdb252c1c87971e726c25d797bdc39cef4730440f7ef089000000067e57da431a1ac48c0d6ed529cfc0b268d8e6ceb72157b7691091dbe80964d8b983b57dd91527e9ee58546675b82abb5e6d2b0c25acb3297057084d29f8deba1a6007549e1be506151e36c69efb8afc2af6ef3f85352536dc2d7c84ce81c52ad31b15155b525036dca9fec53c8d707a2fd24e657eda7c017af4c943a311bffa532c8e944b5cb31593296bbf28df1fbbb4000000079c6e3fb98b57a8a50df79fd08aec70e033df11facbf4e8358da3ca4ff668c1b84e9269cd4be74e9a9cc8223ee895b9095f60008d5302c9a5a232246063060bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01c1ecab5beda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5776E61-2AA8-11EF-BA09-6ACBDECABE1A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2024 iexplore.exe 2024 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2940 2024 iexplore.exe 28 PID 2024 wrote to memory of 2940 2024 iexplore.exe 28 PID 2024 wrote to memory of 2940 2024 iexplore.exe 28 PID 2024 wrote to memory of 2940 2024 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac16f8b789a2ace75e59165cff566b98_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e39f6aa01438c3acf00eb3833dad3e39
SHA11afad8c03334b1d7d1623c71a7c1a9e87bdb9145
SHA256ae3be47c67f062ffd5d5bef1510a01855ce50f3d3732cac22fc272eb16cc6033
SHA512a7be19dbc15496cddf58911272d293962f0fdc3b8a0d0acab86add7ab91f6e514e070aa1d7dd2b081c67755d81efe558aabe3f2f8cfbbde1b8fdaec10fac34ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7a376cca12d1f79fabde462ef642656
SHA133466c3101a7d4e63baad0aea3643e8733e3842d
SHA256991f062247f96570609ce95f2c5a5f0a6dd565e9d12f3e39be3fd9a578d10894
SHA5129baabef71acde3b0736c824ce833d59ecc025910a1e933c2f67b617db8d1893b0d5b9efc79cbda592cdac5e40428f9c4aa6f059c4178acc1ea9dd154042f8878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55262998fb80f8c67e12fd05e1bb93b96
SHA1def72faa092e4b8faacb8a1285a993d6e9162582
SHA256c9f67d4ae7077117495363fea7e6dc2e04ccd7535384e0ae737fc28aaf7e1f15
SHA512aef48b32bd174f31a5f1423e45019f36a16b289598223d9509f38cf77a6831632ef5b0896b6330b80746b47e264ebe3596e87e36a9f14521559bf4538b6a5f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530e4711260dd1421fd2913bc07f27541
SHA17fe42c36044960ac7e661af0a052d6af693ca285
SHA256fac7fc148b048e89f98c149f020eccd0c94bc40a9e00beb7ebd2379d44966994
SHA512219033244f7fb0e3e90f2fbd56692d713a5e3ef85fd90a3c60a99ca624be52ab4dfe7a1978bcfd26115d0b7490a57ba564908189de466a08251a696225f6dfff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52147903d5d749568ce52baee2952f03d
SHA1c4eadd504f055be0ea506738062570e14ffb5877
SHA256ac3a3485298bbad6db88e4893145f1b5b122b1144d9d6e9b4f2781d12ff5073e
SHA5128932d04a25c6dc0e6cde1e830bec2042251983fba5f67647419a68b7de0a5ac5cc7ac78e114e5c2b60b048fb463100bf612e30092a3a7436faef0ed9434b9b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3139f65213394d287912e1c9af35e2f
SHA18d4210b4f8ecb295d2f132836af511d8d2c5bf2d
SHA256370f5b3ad9596c70c277f5860ccd8c56dce5535dfeb78225f19d1583da5235b5
SHA512c9d2c135fd5dc286fa11acc37e3072371b3fc2b16f02d1b8a6e52e5d9aa0a367c6269cd93a04a3d41d15455f278679dc18a981254c54a78e658b31c7ad71543f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59daf8994720b9233967151efc15d81a1
SHA10b3737b8edf1b26b8f9e7c4a33a07d21eb8bb9c0
SHA25679044bc373b654b1da0489866f9085e02dacc182f1d6506f8dba99de05599e48
SHA51258da8594628ebc3888cab42e212c7cb2ef984a7dff9b6948bd0d7ca29ba4f7667bcdb0eb5ee5510183da8575bee88c5d593a028852f9d16301e68cf40dd96d13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5754bfb31b44b0cbcf7499b851e3549d1
SHA14ef30165ce86063835ee0e6757c5a95707008195
SHA2568ec2dd971838ce828a9f505c6c63a9ed032128914ff3705f96f136705a04117c
SHA512a80901285c86b0e233216af7f77f79484f3def14988d1735c89578339eff5babba052cdf0dcfc10915bbaf4f970799ac8a70461268886dc05714810b425f636a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa2a2700d0a86785f0e6e98f7879c331
SHA1f2228c9754d694cba4b24c62c458151fe7b739da
SHA256dc0818f058c728410cee97f0d9e5dfc3b3c5bd08c35c78607d542330d25969c3
SHA512a3e19235594a1fe85ed7ee2608cfccc257eb3bca2bccebfbb7461e061911f678c55c64f02c4bdee649a13e4d51a37bfaafc57f6fa9a1af6284ef99b62d15c96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e757ff06384886b6d4994cd36304b7ad
SHA1816e8e538b8cc59522cb63e366eb8d75e6a09020
SHA2566c9b0eeff9a1e478b2615c444ebbfa9ff844d7dc72d1ebd93f1a1892b03bf218
SHA512c9e020f7b97ea0363f760652c38c8939facacc9b92c7ee71616ede28b9019e1bff13dd3a5c7710369cc94ea7d9dbf3123c5e9441a6642d11e5f52726faa3768e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc3a589687d06f1ddd5003dfcbe11d51
SHA1021a3b54c8322c2670306547cb8b442f77b63924
SHA25675413964ce364e63cc08665ef123ff395b2250d9aa25c704db312591f1e0be84
SHA512b736954bf5b9d06356f73d0c3f195e34fe9018d1a5932c48d2fb34f4a11a37033caa1b3e2281ab00f77a3f0ffa0eb887fa2f5cfbdef1799e82d48b5247b5b527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad17b58c91808b4c445e0058f3c67aba
SHA19ee96069e06716166795a0fdae768b2188e4fa1d
SHA25657c92a4466fd3c2b8f183013fbf9c8b8e80be943f4478f9a2c6e6859b6a46198
SHA5127cc7260823a49cde4968e7094dc767fc9abd7e92e56cc3c13f5e884d59e8949f4c4b5f32a0a45dc6862b0b1f1bd3dec0e1b7f05d1713543586793896534cafd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5924f84db4f10f2cb2695138eac0583f6
SHA1a12daf883d67741d80216551ab96e30ecafa240a
SHA2562c6b908e9119797b15445dd29957c57b1cf81126a60325fa2279d5b191830ba3
SHA5124597a4be569ed81924f7bf5d4f14b8ac5c489c6e7fb848cf20e7e17e36e82ebdeb1525d76c2c8f67516908bb00324b6b0b78929de9cabbd8b38cc29f18c1ef15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd4d1dc9dddbdb0ab147467f011a5c9b
SHA1a6f52ec4f8758660d4eb73dd84aec7960dbb469d
SHA25693cefd7deb010058150aadfa7e60cdf0a0f173d2bb91b80dacf4dc0c062afa3d
SHA512688c3b61040d5d6564d7b20b9c6a5c5b60a9749ab95bc228767848b5b2738b1c7a24d821b7ca89931a26cdef5d23c79d933177227cd44acbaf154a80b82300c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579760353a980628db58e83ad182208c7
SHA172ce340ae6ce55b7f5782cd704b3a6c3234c35c5
SHA25650517a0e26d678888386a4a91f7383f93fbd8d420c4f8ac4d6a21253201dd27a
SHA512d1eb1bfbb2a757a1449917dd1725662689c7670e576faf75e06d837438fcd1c9bf7ff8859d90d12379897b2badfc4c15522103aba847214ce97e6acac171e7a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f58a732f8607d72d3b4b03a2452baf81
SHA1d152180283c8098679b0cdde8e0bcca840ef9969
SHA256595fd232d683c7036f698aa08a94d3d16f56b9e51064db923aa1fd7de5adbe3a
SHA51252d84c5a68112410fda2901bd2bb7fa6fcafce83d4b5b2ae61b3e44a26e4c4f1fdc5d0bd35edd1a6ab36eac404f6af492a4cdc89825b1ab89d68bf840aaf9b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2a0e99843ec1256f680daad3513ebf2
SHA123fead474e6575d49fbde999b8310e8d13fe24d3
SHA256325009999ba29ae138a4eaaaed84744ce9f53ca794d6d74593af2b171c120b9c
SHA512d47032b5a83e4aee70b0749097fac4f07fc1c0aefd50821c8bf0e0fb32a822aa955446069b74ab9484951f9e557c9b52313462c7a66dd7ea1eaa7d7b1d810370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b93954c413054d0d6bf53f6b7423222a
SHA1c7043233375ba8b223eff4437060d6e8b229de2a
SHA256b389e1ef869b0f3f5b8f1284f376ae3976044f045850dc2d052f18b4b1558c2e
SHA512bf332d8eae9a9413872265c68d902a8c1211cc6929a70217282e39ef8e5af60d1d4b75b199499cdc01f304693422e0fccf0a0ec28cffa88b7031b4a8e4db3914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b348f59920beee2b1adcb2ed8c136787
SHA1b4755086a912bcb49ee7f7539c17abfdaaa3c28e
SHA25679958e0c4890cf54a64e2ff7e1d54ab0aa2364f445fc61fd62c3514717ccc8b8
SHA512996f2886bbe1260a8af0c4e19adaa7b21cd8ae77dc528ba8e7ec99344fb850ec957a7e89bdcec200a485a08b623fab2dcd991e272a6ebfb7d8f69a438137c2bb
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b