Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html
-
Size
3KB
-
MD5
a7579050181f1009cc039f029d8f32b7
-
SHA1
c73a057fc1b5dba761e18212097db7f3edf7a569
-
SHA256
becb1890f11953463b6dc3b7fc943eb57cd4e491f7e689256e17b3e7c43141bf
-
SHA512
ea26f4aacaefa68a56b8882c74c6aef55b4495485fda79806060fc9ae7482b223cddf5ea163c5dfc40bd280d084e13901f6bae7d61919295b6df94a6d9277992
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301c9310f3bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006541a3c30d0b0f18e0cad2276168f44d6af6c5107be496cc00078a43805d9ea2000000000e800000000200002000000079ae5906417ba9fa75520f022e24f840ded5af6ac4d3e10476f918a63a4b76cc90000000ecd94e67d43a29cce7a0942f9e378cf7bfcec49ace987d82ed0571aa6b541634dbb0b5ec6ca51212a0a172c951704c056803fde9de5ba1fada27bf1cd338219a7b80bbb979ef278db28084d77d89039bec1158a081c9db8ced10925f42a72005c4ff4b6970d0d54e87ace0eff8e7e4b6edeb901721fb7c3bb27a55baf944931576da2c80b757417b21b37c218b0e470b4000000011788048302d37ca0a614548027695864168b20d18493751786d6849d36e80a34aa17f5e87ce7bfa56334d758ef74bc6d90ef95da5da8414eba91a42c3bd488a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B176AB1-29E6-11EF-BE23-DE271FC37611} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a365ddecfe42111100552629ff18da64a416bb4fa3f16581d02108ba847cfa72000000000e8000000002000020000000d4777b24d749bf80b979a52c988732af240c2ccffe3edd216aa88b642d7434b920000000bc3798f8f6c49a407dc3e26480b4e4ae595d664f9ce69719acc9914867d25680400000004531f53ddfe5b48b4e5a49586c30734b89589738f9190c4b71938cbb5e5a843f047bf86f6c2a06c3b3b3bee70621773edfdd5db59529a1969f09ab0f2123d2d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424487301" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2752 iexplore.exe 2752 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2300 2752 iexplore.exe 28 PID 2752 wrote to memory of 2300 2752 iexplore.exe 28 PID 2752 wrote to memory of 2300 2752 iexplore.exe 28 PID 2752 wrote to memory of 2300 2752 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b350d8f2e2e7ff8fab313dd2f6310f68
SHA1d8f7448b512c4e7a965a1a4bac2ca33765587521
SHA2566bbae6c14c1255773ef41e441d74ae62aa763cf75a3d4c279df39c723a9002c7
SHA5127b602b1b99ee24046113b18e182b3d4aa688664b9121ca366c8a41520c04ed4b2599082c185c6a662304cf44fc03709d91e6e8bc1600ae5dfbcceae547318d97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8bdd856b97897645d7f13c789328920
SHA18da2a86bb30f2b7aa5e34139c01ba59428dcfe40
SHA25626d8fe6803f88d271fe230fbfa5edef25fe59839667bc9c8e5ddbbebed7b6a2d
SHA5127dc728c28db1552f5753a04443e685fa03d93812a26ec9635a9d9fbd0d74f2e2c5e944a4065ec1c634e31c8d708b2475e103714678a069559816af7ec9829859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5838a8f3a3b33afac01d3cc3569e014eb
SHA1a83cbaed9870b6f8837a94a882ae1b626baf8f94
SHA25684b9c6f1980b3874edf13f90470ea8e7eee27ddb441c13dc5e8d672559e27a6f
SHA512d017c5576f4fef5a260995f1c022d8c8156e630f9549d3ef8acd8dd1ec2a0e80499671ffad0ce61ef53227376780befe20e9ef5e05a1bbb68f604e9268040c0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b46de80225f95b724ef89993ba47c000
SHA1aa54513426012c6f60ebe6baa8cd0a677090b6aa
SHA2563a7f34e4f99162c1d159b28bc6c7ed1f8342ae1187b5447c123a10530bb9de26
SHA5126bde277260496762e2ddd681c96654180ccd996411a4a9820573f5bc75e3951b8038878e7c3ae30c9ce7e4c4a5eca209013f70cb4fa08f0c9df36f4d9e1a74b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5015a1886819a1752b8aca69cdd95d7a2
SHA1fd61553dd673d8174bbb6c36d2732d13122be52b
SHA25694aaf99b9f04093f8094a3ff9902ef3630f59568896ce0443311ef39bb18e545
SHA512d857bca1c6a9de7012719f863220809a776e85d0eb6bbdc5dec92d6d7939b202a91c3dee06d9cdb4e1abfa456b125ceb5e3e529f00571f45eb15a55096269d7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9db1df542c6c35bbee06b2d3672bcb2
SHA1be30d500380f8f9b39f58cbbed292a7d4d1dd756
SHA256d3f1974e4dc8f69ba836d0f4f8667e8bbb2d98bd1b77d4867cc887f6055af231
SHA512218e53a4030bae887e4d9ebb694df8677f2fafb46786b3b6be7de03dfb9a12fcbe43450098005f70e0ecdc0beba2c2a9adc7666aa9c6402b7b2bacf10c6c42a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb580d2d849a6db8ea983d91f9668e32
SHA12143afaa5da0b8196328ac2e81e6b44140eea25b
SHA256c20df68313dc96b277a7fea0534579eea43cadecc1fc15192242368596ae3e41
SHA512f1b66a69f3a14d71e925908111f0283c17fca7722753b6ce66e02852cfb5f9faf0a6b1b79fdb52ebd6de1f01392c48a8823173df29b21d0763e2fa67799adaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f77cb9759aeae98baa76628e9da9302a
SHA1b581326acb7a513465b9b4deb66dfd6566c7ecff
SHA2568d388ad850fa096fcc0477276da73779715c75477a8bd2176d4e445000abadde
SHA512b463d3e8f365a9552964a86eb427d90999ad2cca44488d253f19cfd1fd70a2cf44e28632622438053d0f1ecf52110a162a2306817d6f993088ac61137d6c76b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5940ad963f53cb5dc0eb903f243d9315e
SHA1ec59716e83941ffb5fbe9ea8275bdc48b3e54fa1
SHA256eadb7b48fa85a32df7df5b0784247cb778b476fe53059fb12a8be258870a3074
SHA51221a78de336f06f96a12f12314b7acbc6fb34dcbf350999952ef5540a5d1e8e7cdffbeec35eb07f135a147e232379a8cc71f8a5e7b73c143f8fc2c9e953538d74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5716cd28a550b18f34900297d28563977
SHA190fa39ea1eb90fcaab98e70839f1469f999fe577
SHA256f478443992900627eddcbbd20e7eba97a8f581e67210c71e7a3c0f053f1ef287
SHA512e0cac6d6eaa87a7fb718f2d44ea03103986f3f9a1a2bc07f8d979e440703ed000c7f380e2830e94c7af478e600f11c335edf846f1771fd5aa9a50ba0e05e86e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6c647b46a262fa3cdaf05904bb1e6e6
SHA15469ec52ec032d698f65363be46a93c3dd486e79
SHA256c80d3f007c77be0d6a5959fb23dd731bad249ed279d846e4753c6a0adf972593
SHA5126998608e991e4ccb59b02e2a8154071920739b4439f7b882f58eaeb2e4e765d08f6f9e8916d27efd3f97cfd1cc918e1b2e9ff6e79e772693c3c93f42e02d9776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a59cd8f36dcd98e25425ac8963e73638
SHA138473566dd7e56c708559dc6d9fc532d97d93de2
SHA256f6875dd745d9f52aafa3b641f843d3eccdecb06559b9d568581d6b09b47bb8f3
SHA51256dcc19cc1a65475e6b40fea8133e6055e441c1a44077d02ed51aa6d60a03c66071e4f8017256b17d81648eabad6c595cfcb99b84a6829b3cc043b84bf758c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5402f12fb135b00fbd3b4f94dc6cdefd2
SHA1567e1eaedc549291847c69467f79212236e94148
SHA256395254f5f3be8e0d2a20655038ea1c03a8476c921fcea548d2806f426eab4443
SHA51242cc7085275d122a1f255353b4331492257adb280b7c629b94c84fa449e4b86409b4fe20b58931a790844ee0eb054d834355c6aad76327621bd12c7a5b248544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538d914980f774e17a58e2117bb5d8363
SHA1b5a6b1d6313b6e05d5ac0d864ceceb11757d3c58
SHA256ca9b2249f0cb4bf229d144feb01d7d1a03129a8f9a27d4890abc609986e3f83c
SHA5124420f2372c553ad69cb7fc9ed853e99fdd4e5f284e28b45dbf6d76200424c8bded3a7afc470f7f7e5474fbbd0b9c8e52bb0767205b0d5e777bfd951e34af9698
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b