Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
a9a036d854553995cfe50470df892400_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a9a036d854553995cfe50470df892400_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a9a036d854553995cfe50470df892400_JaffaCakes118.html
-
Size
2KB
-
MD5
a9a036d854553995cfe50470df892400
-
SHA1
1d7c403c6da83a4fff3b4d4c0bc12d8c6e1a34e2
-
SHA256
41b191d2ad22f2c64de2a7fb667b33bcb7b362643f19ecc1f39f772a65c30f82
-
SHA512
930e0e6ab350229a5af43a0a6f5355a5290c50fa5b62da78e094662072f904477ba7a815c05b3cd3f64a022b0b48073600492d40e0d37231301fc55a18d91e90
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F38BF1-2A47-11EF-90EB-D671A15513D2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000b3029d6fce9e0ebb28ad0d4f9f10f1f5a0670871be70f6ae2c8427afbee6b3bd000000000e8000000002000020000000ab3d7d25e1e0cd55132b941989c5f8eae91bca8eae90752a606eb7dab05cdfc420000000eed7c4491c58756945c0389e83fcae7b9eabdadd5c25cfc9e8213bf063ac92ee40000000482999b4f78315b5d53f30b38d9ff095613d819695d67566db7d20b10c80bbfbe93fdd05b4a0ac38652f4dddc3b65b50335b694fb53ddcc1197262f931de6811 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000004fb1c3cde5d4ae86f501dd9fd2d9d1ebc0347cff24cbb694a6676fce4a691272000000000e800000000200002000000055db3b98a3593918c680e62455a66e66bebe5ada9ccc33aeb7ee600b795c844e90000000cde36007cfefcf7d5f81a3ec18d4679c8dec9c9884080e62dd5c8494c18e9e66e6d72ea2b9a0df947a8b25fc8b9efb59cb2b93cd4ec4c7e1f91a583702825804ed3554dcb7df71cab9d9e34651bb0b57a63155ab07ad11e3abeb7cbb52d31e6c221b083fb845c94209fa4b43c5047d9bb639a59f050ce62e9e553ad1f730db2b692408e7ad6f35f74571a3b1557c83734000000018a44471dceaf2f1b861eaf197eccce586fa4fccdc5aa7f3976a4d9a4b5964746263c4bac3cca49a39d58b618389a2b07489660e8d635dc56ed76569ef04ba08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a293b654beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424529236" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2256 2332 iexplore.exe 28 PID 2332 wrote to memory of 2256 2332 iexplore.exe 28 PID 2332 wrote to memory of 2256 2332 iexplore.exe 28 PID 2332 wrote to memory of 2256 2332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9a036d854553995cfe50470df892400_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c98e1577512a6ae79e05a7089693130f
SHA163a17822d0c9e83cdafc943404015a4c5edcd51b
SHA25638736c1fc1d70ed66c44d77f81347504b7ab2ac9d993fdf4487e3f9fbf4f9d8a
SHA512cf3ff25dfdcec033f78c08c949cce58f7f27ee2dba1aab1ba58d69af8607ddb0fb4c6f6325e305329c256044194d3c9806acd8d9da692c20cce8d6b929850a4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e4ae726e14d16d16d6ce1538e77fb57
SHA1d5d91916884bc7316047f14092307bf2cf2423da
SHA256563de13ebdfff31eef281df726d1235ee06e53f607f307f29c307f00f2897f64
SHA512000648fbef8a3408e847f3a26adce44bdf1f944d170f29f07e97d4b206e4215909f66ced4c5cf52fdc5ee6379c1c3386536be968788f536012b314e77f7784c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8b5972dd30d7525b3988645c7e58b76
SHA1deee7854d52a686a84eae73e8917ec443a5c5f3b
SHA256f6b24abe62fdeee1ddaf6b9f1f6d6310b927646f7dcd7c2029b49c1fb57534d6
SHA5123ea69382070d615e25ad70b65ff8d42df192a07deee42659bbe99df4dd6c7db53185e9250ae9c8f3d65af9b946eba87fcea04fdaa7ca5bc4c5f78102316739b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d195ffa4fb267b69faef7a4bf1840b18
SHA1c7c6d54c4adf66383802c1a57aa41ce6c3d12dc2
SHA256eebdd2aaa40782bebdbbdd42473e80cb3b8b50821998a64fb01b8d89c22b040d
SHA5120014c81138746c4b806e6cf7e05c647dcb486ac482d0337919ffe23d6662a74f4e8d158b27326483fd55018e7bcea7df63767402052107d49359a38009c79a13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54944eede06c214c75f042f2de1f71071
SHA1dc58c896a5f650dd680050e98f4a9e1e3d3a11c5
SHA256255fc821dbcad2b3fbc55bcc2646643f56ea99e70db57346ba8870cc8a7d32ec
SHA51246d04376fe883b9d3b842bdb0a93bf440f22974fb2dc559cbf462b7fc4f594ba1a8c50d4aff878e4662e2137e664b45a6e291f87cac1192b509338a43425ee5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d3d637a1ad353fb67b6548eeb02938d
SHA18f22be67b963ef1450bd1686d2d3b7b6d2670f8e
SHA256acc6b9bdbf810164e3fb775840331fbf2983070b6e21af10497a83e6c6c9f17a
SHA512bcb19a2ce18f0aca21b812577eb62195b20b9ec2d1459e375a2b2056e085d2fd53cbfb39518ed45b07a6c3d9c76f3178d450bdb32c3331b48a9a326acdb41b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520e9c3eb3f6883b202eed4898edf2af5
SHA1fdee84e0377dca62a5230fc1e0941c2c85543295
SHA256e6afd3e8e578e56a89d6f31e3daa826794c57584201ef4f12d2aa0a83de15c8d
SHA512cd67701512e02ffff41ed5a18f80e17c60f973fe4d5208bcb76ee4c7d8da8e17de815be4169c8140ec7e2ea7daaa7a21e00f19f49bd1d9f70d08158b6d9466b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abf9bbc8fa6f9583e0aae8ef2698fb6c
SHA17b675f0a883aed72a48bf10ed19475a18c43ea67
SHA2565837d1206bae41c9f54c0763d55d43a3e000227a6a5da48085afb801b2587499
SHA512c094e6bd1b755fd5c7473bbc0e29b0a43931db5355051df2e0277da2f46cfe9f853fcc2c595c661e08434c2d8bc1d778c194bbde212a9aacb6ddb1fa28e5412a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561e17d5e669e7ad3557dbe5f1360071a
SHA1a0200077cc7e83a0f78bfae5d97b130c30d9c36f
SHA2562e73638c5dbdc35695dd0cffe3fedd2a7f0feab9f28123b25c2c1df7dd185c60
SHA5124d0a8609b83f25d7c465390e99c62d832f452a177d5b1381b5d0c28dce7bcaedba3091231cc48759cf302211701fc00729b973e2141c0c42d7c056821780899c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dfda4776e1b9b9419d1c4541a83fdd5
SHA149626b130bd094e4fae11fbcce37c29c17c76fe0
SHA25625bbe62cea579a7d79b596a586658ca3d357ed7a91d8e7204111141ed31a6df6
SHA512dd6671af09011b67ce92ae81a707d51d4040f37c0f024ccea3fec62122c420541c7d359e17d06121b200def88d8848baa1e236b55ebf4196957a94ff40dedb34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a04a235ecdbe57dde31741a4daf859b3
SHA1add9450fa2eacdb8a6c4bf96b394330c6c416203
SHA256ba35e0c1a5a818ef9404f5f643218fccd4e2baae28d1c03c8430a378f015aaf6
SHA512d5e5bfd834adec2757e426117bd0cac609243020684c883829f4147c982487129efe9f08692efb31c6473486d0340381f5b05941b2c4be3a795e0ac0ac244bd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53df14e6366e8d7166d5826d21a7849e6
SHA1625419182b974bea91c7b318462853783e298637
SHA2561dabaff537b1f1b98c496f2221a96acf93cd09fda9b3d3454169cfc63a87bf5b
SHA512e3e0de09f28fc8c89070f0f9572eb51546cdf0add8dae7b75b7fc3608c56c8714ddafb4265f5a0989d094fdb5d773b9ad5aa98275c51b63b5f2109b2fb930729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d73f761add8aba75a6717e71339a50b
SHA1c36937b69b0338f048be86123898b4832fc7aabb
SHA2569f5b38121ef04b6c595799573a73f2e5d26baad898d4d1154c6c5a4d1b2a4055
SHA5129d1c8f8ba6330092d284ba88c7537e2fb6739412a1f4965e594e02bbfb608e492e0622b1f443a03bddb8f88beaa18d979ed1f76eafdf743d7f8ba9cbcb97c7e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542d83c81f4656d9eb2f96d866e8bcd9e
SHA1256221f43f60845fe97c5a7b636536bdbcbcc9a5
SHA25682bd1b1fac4a2e627169649e2387078c21c6ef80db4fe628cd20ba94b3dd477d
SHA5123e030ebab07b0800d7a51d9eddd72c1bf6f5077432ad9a5b9d4a339e997d56ec24b6e23218c96311337cc6683ea94d1338b263c061ed5eb39a3610eecc75ed5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de9a8e03fb6d989b345f446f4ce001be
SHA18370181a773582a29a2c6ed9b429f136ba7dbd21
SHA256b2029270dfa63b9a39b3da190b9c0d2861b97ad7f291389875f89bc78e3664f5
SHA5121eeb4f6c57b5fbea00487c0b1163cb363e4375fae49e07e06fb92335f685f4d0747ce28a4771059e1a4946793d0c68cb50df17b268e9869a787fa9bb04cc07b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5820d36b224bbfb63858cd484d30a15a7
SHA107aa6fb2f84dd938523ebdec3fa4cc7f15c82782
SHA256783b58465d32bc29cb3bb8339bcb635385d716876446124ae0acc0f357cecf9f
SHA5129716ab1abeb439183f866e7d5981a6ef0f434bfce7b6a488e20b724bdb607132e5a5f7d9d7c611e28c41bdd98eb7acfeb62150d3a870799eff683cae1aaa73b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4a9416831ee1e3f34571aecfdfc80b7
SHA14677e8bf237bd58ef65a463f7300a8d67ff445c2
SHA256b6d91a11dfd2e066696fe9bd25e88585b49f3f1261574c825dde1d25cb07453d
SHA512cee47399408c32d9a29e0cb261a8123b373dbbc0e5f4fcccf450d75176d1e477938be434f0b6bf84cfe5b266331ee81ef1465d7b2b61ed8e433fbef873e05e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51527408afc781dc4c64af7522769e0e5
SHA1331e47f8bf905134955f664ec88e3854c94e0c55
SHA256fa55922586d2c48705d94fbd2cb7f6f577305400ee85288b2b1cf0db6db24b08
SHA5124eb97cb42947ff7e969dc091f4e6edcfa92a7b0b89b3b8e8632a4d41860d6119324e91a63c7d792c8bd744e836d0446d9a4724d162eb70549ce16b5c2e4647f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58adfed8e901238160a75c8b4c9858805
SHA19435cc382a0957df899878ff9d8b8587f98da00c
SHA256f57b760a402e6f2b0cbb3fa3f6a12ef183466a8180b1cf85669e3c33b677e0ca
SHA51262fb3e6866f5b07fd0fba651573d456be71093766abf10e3a245572d45dc88b35ad36052ffb89ec311762375385940b9de7185f6882fc00872f05411b0214161
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b