Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
b062a4053d37d721f03e77a2fd108112_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b062a4053d37d721f03e77a2fd108112_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
b062a4053d37d721f03e77a2fd108112_JaffaCakes118.html
-
Size
51KB
-
MD5
b062a4053d37d721f03e77a2fd108112
-
SHA1
1f7404f0b26a5fd8f28419e60899a74c29af2839
-
SHA256
03b4f7298126ec9e503ba6659d677d01bd24798f024dd6613382e538ac25475e
-
SHA512
fcbfccfbdcfcab0ba6cf4b7fbf84a7e67884738eb7c6563bd38fb2871d2bd8421bdaf11647238ffbdf8324d13171bda46d717191c1fcc32f9543f98f5d726dad
-
SSDEEP
768:SoYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Sol9bfisxu8kmu4eSPfiM6uwjg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102a72dc71bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424651736" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000000d1e6aa284f3012359b0407965d693e2c17bb11b7d70ec9a5a78f9e7f0f79143000000000e8000000002000020000000e23fe311329385d9345ec1124c56eb75987331700ecd6262e83dadcf529f6ed120000000b1d8050236d5e15142c2d7689358e16a03b9291f0e56787c6131a4b342e6d9c8400000004bf7a0318ee696a8fe318f6ee05eb8c50bdd59eb47e9c9c9af8636d4ac6a5fa3d81ef16f048fbe4137ba2f8df38cbeb51d0e4a363266bda0e993f9beb2224786 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{199921A1-2B65-11EF-B9DB-4A2B752F9250} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000006809702aa6238abc8ede9606772aa97e3aed304c5c75aa8a3468ffa88a9e45c7000000000e8000000002000020000000c09584ada3724ec4a4af573b87a17b4c61cb49f1ddbdab8fae03d1b263cd2aa790000000894f949380c026b47a5c1a53e108908abd55018cfca7bff8432383ffb1609533cd194cf109a2f15e431c10a7437583b8638ea6042c9d35aac11dafbec3327dda680e33a4a3ac9b5d85932024aafb93a7d37c0c0aec57d82eb58ac06ecd03b51fb9224f2a03ec528d71b20513199c4a801397d02ff2c48655fe2a61268e797aea797c34f23c124fdb2d594b34a14d11044000000015249a465005f1abe80489fd5d0af45a329e3a6b5a532e00e12690b3c286939c5b30d6fb9a6b65c6d8524e5f69561ed0ba45e1a14b421208f4e0c2ccba6db70e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1512 1936 iexplore.exe 28 PID 1936 wrote to memory of 1512 1936 iexplore.exe 28 PID 1936 wrote to memory of 1512 1936 iexplore.exe 28 PID 1936 wrote to memory of 1512 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b062a4053d37d721f03e77a2fd108112_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e86b29f5818ef952f4792fe2c337f453
SHA18a3489b9ba441a8dad3a96b55a2446242d038692
SHA256b59c429572ed2cb7dfb197474e7b065b9b72a1a5aa4943f2f7421ae6ab4bce8b
SHA51201daf00c4b08d2e5ff6ea2b9e66fa68da01d42c3fbc8056bd59913049972beeef6606e41994f5ead1ea6b076fa7e6d532cb8f347d52a9affd54b394575d6d519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58852e0cfda3acb67d91bee89bf393543
SHA1d6a828f26c5ff3b68ba01e523e5312cec9b03b7b
SHA256ec1556ad2c208166bae9f53b6e6fd515d2d0c6057c72c1771019e5b7d135171e
SHA5129c379c94addbfdf3a9a4e8d8c0d9ae9e2e2c5e8e4ad7b0dc8510b9c73052289a1dbc060e968670616b74450fe2bb441c7e19759ca7f6b37ace7e82f37db3f7cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569a6d830ec79d1820a03e83e04bf80ec
SHA19481b0f366654aed5c63c77f9c24a7cecaf52f34
SHA2560cde01d9c1211a9672ec810979824f9bf6e403379820393714ea95500a0a223c
SHA51239f9d6c41111dd8ad931618ff2e57d2743d796ad6c1c80dc239e7d8dcb12d958b5b8d900b445fac8a04ceed72e6b006416b6659b270045e3ce7cc1ccc3ee7b34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53db1060287ff7ee1ea343b1e8719a040
SHA1267773dbc02a0369887a14c0a9a5958f62643cc1
SHA256bdf87d717661f2b1c8d8759a636d383fad57db2556e5f8905ce7d5c5a59fac84
SHA5121aafc0a7e184145120cb5da8f6555624c85d2841a4fab78c89a41bc13df04ea84ff32f6023375d7e6e7b46f6e77d0c6f50e45a57b841af2fbe1588d0b68af6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc5b9354b8ee442cc65443d4dabd915f
SHA12312854206d3578b6b9e2b9278f3db36a711cc3c
SHA256b1bfcc081b0d7a3e983c3b4ca26920fa21785cd99ef584560e3975ba7b7a1c09
SHA512d7ae34c104fca6783f7d5396a36c29d5404136d28dc4f42cc6989c28e2fd45cfb2cbda3436ee3f83de33f1c3d4af256b5029ff29d64336ffececf88d1de9e4fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7394e44fe85aeca1201083dd0c28d77
SHA1f4124e882420a40a67ee8a38b74788c4133094dd
SHA2569d17bd9822792051c91d97cc09ae2196993e64903df280b90b5e4bf5c6c1b185
SHA512f68febb9dde55f87a47af64fd384ba57f57f0951d993795da5971e70dc05ceecc3c8cb0fb2d921a4e29be61e3f05925cf36075a058a24c969eea45de15a07afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553b2e58b37c806fecdcdc749f07d5323
SHA1d2cf4e7786d70438245cda6a7042d5c28b439c33
SHA256836c998dbb50f91fd6c68b235ac39a19b64346e8e3d0fd5464aef5bc8877f821
SHA5120aadd48af63675cffb060d998e9f98b179f170d50294dc91370ab01b03ef0a217361f93cc63fcf615e4003bf6689d66e44b283fe1bf4ff6f180d931f0ec55b8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4cbe211e9c4994989b1d366f431fec0
SHA18d91d9286f104df0e446096867806a5f6afa02fe
SHA256c16ee4174ed55591e033d8612011438219c3c3e1e0b57ccc657b26398a5d364a
SHA512789577d30510ca29d70f1f5b717766e6273f1f97103331438e559f2af9ead5777c0aa0d460656aed2de568f688f064a946771724a93518e4870a432fe0452f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ae318f301bd87e22d48ac824c0450dd
SHA17159d47cf6311ecd2a7b894c5f68c62d87c0202b
SHA2563c0fd6f6aa53b14caa3ffaba4a1403fd65b9bbcdcf98c2dcef45ce95072252d1
SHA512155423adc193b1a9f7ed8d3845957037871e3e54e030d9f5d3535c558546051b73825ee90befefa123a91c31c223d22c87079e39895410885b05aebb8f62ca68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a73c505ff78e73b3c89c7cab40a6302e
SHA17fb6ee50a7986f6c8d31837a26deb1979485c1c2
SHA256a43dfa89ac6d164e68a7cd64162399dd5c39538e2a0d6f0eaf2324e579f6371a
SHA512840167a0fccab035dbdf78f88208ebde1bf5cf9f83df9298e38bbd54e67d75b9caa4ffa2c13704990d8ca1f7a734adb169e2247626aaaf3c2fd7333762cde3a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5037845556d9af479d062b316e15d25
SHA16ea899ca1f7003aec3edcd2bdab02eade9e1f294
SHA256e0a498eeea178630a28ec684b2e88a1519e78e24f84b550e85fe37e72c2bf42d
SHA512a3fd7f98556cdc8b0b4668a5714d464e667fce31639c48d4256b56f577fc0cd8b6c0fc9230a0b4bf874c1290a5905c1d054dd4abc32c5bc90624b8eab940be93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b913850127e7ac93a812766fa4f7e19b
SHA1dc2aef40add74b9f36fc898fcc689e78a77db075
SHA256e809f13374fc62875d04cce8f6830a634bcea26db837009e376f0e68857b7cb6
SHA512676e2339563f20c75d65a7a7f682c367281803f85e30a21c76057745b72a4854d230f0d69ff28d6118b11e2f15360087591d3145ae94aa3ab23386d9ea4e6ec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5167faf252229093b99d0b493dfecba38
SHA11a8f6852b739f9210a2851412edd47de8f8c5204
SHA256f5088022e32e9c857ace4c64dabfe82d5cf27b2c72d699b2629aec74bc322dfa
SHA512c108daae6e2adc1d945e44f700aa22c93b08b2d35d5739e0e1f09a8a462d944f2d16bfb1223c89c93fe5f973527ed68001992002d1460d53665b7e182dfa058e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510a096258835872e5f05cc26c5deea01
SHA137fa34bff2030bceafd3683c54f548ebe22691e7
SHA25686e185dc33d8b7721338becc02d5129b2097546fb5bdbe07b8fde8f9c94be710
SHA512d572795fe08b457fe1f1638521ef4279289763c38167a549ff7869619063434870a4cf3178e150d0dc4aaaeacce1929685c4565eb3a341239de60b145ae5e9f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c19012c4464b9e1aa3025529724456ab
SHA1188cd2086e6c4899e4570273f84c9d47afc5040c
SHA256a0a36958113cf31b2f09e10d89b74f66637939c26ce0421244cef31ada9c2ec1
SHA512ee390fdb29392c0cff9f4bb9624cbfeb52f64f2a3d2ef424553fea27e41f55ec859770dc96e4cf3d0b4ddaa0c01619fca6e29a3d12c48fe3ed347bf132309e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4d5a04902f5106fa1027b591bec4ade
SHA1a87a3b05d7c25d38ea7815ca70954fc136edf8c6
SHA256d487a0e23f55503f20cd75226b52ca829798b4040d55aaa8c312513702911109
SHA512af01a6ddaaad681bd563e8789d55de45358b239651a9b557c0084b57b0019ac4a7f4b4fc4b60e38c2d93cffe6dc29e5f7d4b23b14c05f9a5247b6a02f3641e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c1f71a3d149bebbf0f379d3be44ebc
SHA173164afbbc0d5166a9f8ec6c971b87eade744889
SHA2566ea8f28ed994fb406f148a6c259f26e1fe4b70531c18d09cc453febd0d0b3083
SHA51262463c4414c4c916ff44e284eda7154e6e9e3de631bf15e8b09dedc3196b520537210a69ce6123574cfbe63784ebfa6a3d6940402a8df6514ca103510b84d97d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d869d70550ab1bedf17cd91f7c48f17f
SHA15fe234399d0ad42a7ea845b5ea430cbbbc284d32
SHA25606d54b0eb43e473f21a72febafbb05769e1f12085a9144cf45ce597f7ad34456
SHA512c9cd66cd74a5ab245dd7a946ca9c4bb7bcb4f807a2b427003ae3020cabc5532d815d954c5f907dbdb19df798c15d391f7b23eb89cd749dabeef90098f97fafb3
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b