Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
a90fff15115c23d0791f128a52f76993_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a90fff15115c23d0791f128a52f76993_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a90fff15115c23d0791f128a52f76993_JaffaCakes118.html
-
Size
17KB
-
MD5
a90fff15115c23d0791f128a52f76993
-
SHA1
8c589cd250596caa9fa2390ad10a257667a7cec6
-
SHA256
079bbf24417077e46ec91bd6c9f44c9338643917059bee35c72edd5e5a186b39
-
SHA512
f8e1c68e846f7d16fb25d9ed75e642831d4e6e5255ecad6f760678cc93d7d080a074c585f829ae380705c26ee7fa557aa45f6abd8b8499f19a881078fdabf72e
-
SSDEEP
384:Eo/IM6bsdYWXaHiHRH9HIFSovJS8wFIGrKVihEfxEvBzz:ngLIdYW1oPVihEoz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500026d640beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000066d35712da0c0571847e5c881dbc7847a15f7c7ddecb068ed6804327d9491952000000000e8000000002000020000000d13592d7428aca2a998bdea0f0d180ffabb0ef820791847edee948201ba7235b900000004b3d581046b83a94495cdcca091bab6f8ae2f42fc244fa5de61cab06cd35e80714c006e14b9a8d1f0f5c516daa8da1527cdf4aa24a8825cd22e9c357d8e20acbef4686cf57da010a404352c3bd178f5890340194fabe17201ea1950eab84b148fe2a81a579acf8b2f1494d1cd4a75f550473ac7bac0d3fb15a3c4b3e1592196960f877e6d2518446f58aaebdd1f56a3840000000e13fa2ad38db9a0a3602f0688275738971da94be346542fb7e7f182757fc54b0216e8e0ae735bbaf97c07550e08c97d164217e349ae59efb0dd847d6bcbce6f6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424520699" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000fff64065acee288ffaefd9dcc00190b61135b8a5d1097bfb00907e8debe8bda9000000000e8000000002000020000000acbbaf74fa2c5efdc74998f1b0118a82ff8618b59c528515dc82ebcd7966ba2620000000bd207ca16a1db69b1bf27469f1e8672044c09e0d152e683078b99765c008972e4000000049c35ccc769ef7a20b2371c9a3f8d2c6e9a41420623bc3476e510f5a6fb458b72ec33e08fdc8a6d9ff9b7edd4fef93484dac7dcaf98a17275aa378ea1afdc8d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00256F31-2A34-11EF-A155-FAD28091DCF5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 1964 IEXPLORE.EXE 1964 IEXPLORE.EXE 1964 IEXPLORE.EXE 1964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1964 2316 iexplore.exe 28 PID 2316 wrote to memory of 1964 2316 iexplore.exe 28 PID 2316 wrote to memory of 1964 2316 iexplore.exe 28 PID 2316 wrote to memory of 1964 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a90fff15115c23d0791f128a52f76993_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf97c6756aa102ec75a3f522cab1d170
SHA1ae347983322dbeb845ccc8e4b2b9ac9bd50c8c78
SHA256fff3d8bd4b9f253fb4c366eb2dad612ddf879a60cc388fab9def0e9fa4e2fde6
SHA5125f5790ce6d17a5a4a508400b60872ff0427c5a75a34a4848dce3002456ffa3c6921ab2d0c30a6a983cef9b0016f32e19f3be627356013ae9ca5c6825002f59b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3677a0ae58e9b30f9d14a8057d41670
SHA10c58d91359a2ad67bf6efb6eb024f4e280524d07
SHA2568dcbfdb5786ebcd7fa3f7a71fb7b88d71d5dacb05dfa2a4b62079c0f2d424ea4
SHA5129dec6246e26ef6a16aa882cd5034756967b0909ce39043871cc9557fe31617d74c9e28a3eebae1b6c6da7052a9f855e76829603a836ff407d399afcbc5e65c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54914e16d913f10026468b32854f0428f
SHA1cd7c1d736131384281274833fc9a8676bf9c40ee
SHA25614a55bf5f262cbbd1e837c942ef4238cf086cfaf005d4f9a03e5587d32dc96c9
SHA5121b5d431405e1b6037e28fc0485314fab6e6cb96072f02d1ffc191410a15b4de61c1a7c95ace914954dfcae43144bd41e9ce13d17bce4c43aaab888c092ddce26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb4098226bd138a16afeeadee3b6a723
SHA19935d686cdca4464585808eb4d2e7e93dd235e2d
SHA256c550cd09d9817afcf361404c4931e557c863ffe5451088121b81807653d25a58
SHA5122b6138e887674da245c8e068b3c40f73fa2c4ab66371b369e1e5e8a78dfd46479289f3ea167654806db87a2bef4739c52fab92d8c7b3b65bab61912ef5ce7b98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3889f65ee340e00f8b953cf5beced00
SHA1ba2d67bfaa66ff5abb6c8d5050065fb8514f9f81
SHA256049bdaa18ee16a69544b54981d2fcf4729294190ccc48028d6d9e4ee2c9cf204
SHA5126a77afb5cb0bc082e5f2bf7ac2613335bda2767ef384169ef5a00e48cef926985c9e411ef911b094382dd2e5a2c0a35b0bcac2346d1f581f7415e923fd0667bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f454d2377fe17d56f592530252561885
SHA15a9fb5dd643e62a19e365b5fe39e2d5c5a1bde57
SHA2562e1b249764173f76959ceb42d4f089668391b6cd40013fd78f9d3d3e0007cac0
SHA512285b92ba17492748fcb08caa3b9de86f48edc930a43d24e8f0444f0f27cb8f4a28844f00cb0f1ad0acd0012b31da95dc530aefa3cedd282ab786c51f5ce58601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5126579c7ecc21c4069ad5b984f1570dc
SHA18be2f1a70519b4ea8961bbe53bf9ef370c651d46
SHA256c44d9ba316719047a14413963f8b167d7653e0f8ffba0d81428b974ea2af721a
SHA51253fd5edefd572e7065d8e72427243a5977425cd34e8ebbd749541c6cfb736ceec87f0bfc438b7175fd723a426517ac5a50b3491e30bf9364fb09a1113bcab01e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530a65dc41775aab8d0b22b2c76ca258d
SHA161863b4d2ac8e8e5eabf7b7000769587b8917bbc
SHA256529f5a11191f0aa52c9048f73e8b7674097a1c11abb85e050ad1550fbd652e38
SHA512c887ab80473271eeaade2ff19af9f436dbb49c6377ca76f07a2df357fb89c03364bd82dd6735699d61d592c582c84fd8e98fe9107887d7c169d667f34411e875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5729afcff24080a16c27c32077baac31b
SHA15d45bfa9d64c73b9c8c1454230acd4e417ef3b24
SHA2569775c9d406276cf5188f8929935f4fe1a720556f5efe34b94552445a0b82f5f3
SHA512d52091c2617ae76c180967f7efb2bfee660be82a7c03187e11fefcde046035e4e10aa3fc741ba2d4a480c86bbfc06487d425bcd3668b106a85427c07727f58b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533fcb07155e50df113cdc8682a9e6987
SHA14124f87576b5af1008fcb37191a11dd8406c129d
SHA256f4a87473ec63bc65b319c14c9d96c237e2ce2e0551a7ed8adf710f387078d384
SHA512f6235119f0e1de890864d38731e0244207ba39a2ab878b5f3b8898edb9d0b9c191dcf59b798ff93bb46fa6d0fc17512d611c605ebe7ecc40c5506ea97cc9ae53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6e0b3ce1c3c415fe03960d79a961671
SHA16d392db6d537dadef5223950bcf6769924f60745
SHA2569e1e959bfeb6ac6709592e78b172dfc8b7cf5ef0c9f22e762f3e16b13f287015
SHA51292c033adfcaf966424a8d149bdb600d1ed4fb1256ae8e91cc0459109df602e628dae50eee05d51086561e89cdab75364ec3d53d8518faaeccbef9eb7ed1923cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56730fb52612d252be822af9b31acb3bd
SHA10c0111ab5d79a46100f30d3d3669626e77b78e03
SHA2567ec235726a313ad41973e689e7353a6f8dc5023f4a9f99624f05d9805f35a3b0
SHA512d6e386d7a54dee8380cad8fee8a541a15e6e30c9f04f39eddb98e593d2df80c48e14aef82ac8fbec078c8a4aacb9b0655d9ffabeb86eff06002d9966f1c6e911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bce986baa14d1f9c450c3d99191b5a9b
SHA1357817a11a516121390f5dcdaf07c406f0e1a88c
SHA256b27ab3a970d009c6e916434b827a0b91b530b4ed0645ae58d71d5cf8e77761b2
SHA512c893cb6070dee48c92ed130fed9ea5b08ed792e7d22e39508b964ae2f6018900a477e0c58d80619b9ec7e085aaf9b22b4dddeeed162cf1f6bf2329ffa0a7b0cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579719d802b8986d3068b256db7f0ad45
SHA1efe86f220ab31e45f6e53a8bb1c5e9919b46f4cb
SHA2561aed008efd38f56cf437dd92cbc33de84032d5ae28ecda71c44477773f50e0af
SHA51231d27ad6b6f62800350f4bad41daf31cc0207d188f6641d1fc668f3465271f43394fe9eaed6578b7e7a50e5dd2d77aa2c2d815205808bee7d743ba26017dd15a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e95d2bde8ef7e0accf422a8b14a8e5d5
SHA1b309f14701df9366c8c5081487a193c2fdaf2939
SHA256864d0222d82496d0f92970e101e2c7d578696ccde030fb49757a2c1ea45bc028
SHA512d52dbc1b0621851123b76831f82fbdf86009cf3ae64832fd83e56f228d5330e487451f64f5ee174d1e2c61677c08f1333153d6ae19b40ef5011615028c0d4d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548e67ed0b7b11b64bfdb973757c46b34
SHA11c36a4bcf410c21358fd9915abb293d0271e6658
SHA256ae774ad03ce15c01d7ee9425249bbd2b1d320a790fb7bba370436728d8d7a71e
SHA512b5afde04ca97c7d27f3c24f1b1324fa031aef2d0dacd7359fda597c2aa8fd1d6910b91c7c78b12f005138152261ec2942c8dedfad9d6be8bcf0869641d3282d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8ee20d1a200e4c6a5cba0a90823abdb
SHA1f21d3a6205d21568b6dc5060df4dde458ff64f61
SHA256fe0fea879a73b90ca9f468f5d4cc654e23d8de6deb93bce8694edaf6d3eec39d
SHA51246d264ffec6014d547b8e336c8d4766cc670cafa3bc36a310dd78236ec3ac4ac6779c81a6cf7f604857f153d2857d475fdd23c8092004d3f650f421f24553ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f124fdc529deae7a46689f770dc1e0e
SHA1e6e62d71491f5aa2bc222facfe3da6848a1332fe
SHA256c6968989f729f8e3b55e85d107361c5771ead60f82ccb55b7622c55f2e3c11b5
SHA5127dcfc00a944d184b3c4a6bce869ea4b634377c672e5ec481bd6851659bb2886a669a371bd81237e11ae0a39ef4a6a5d4ccc2acf6e0c82c501a680e1a9a88a3bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b63ecd9c2efc0bd14e122f358a541aa
SHA17065cc9e6fd5aad0d3974c80450ae39c40666584
SHA256f6d51d31c1f62daffd134ca1368e651c89d696c293e7427176d0378e5370adc8
SHA512af54d9103d39bfb00bf8ba60e19973d2333a8992160c9490a137c9001c833a8a53fdfc878ec6c3515455c3b1ced0557d0e2ad30699d075e6d1b541d7c9695407
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b